From Eric Ball:
"We have several docs on implementing Sonar jobs for various languages from our global-jjb templates, such as this one for maven sonar jobs: https://docs.releng.linuxfoundation.org/projects/global-jjb/en/latest/jjb/lf-maven-jobs.html#lf-infra-maven-sonarcloud
We could link to those, but I could probably put together something a little simpler that would allow for faster implementation. Also, all of our Sonar jobs are currently built using a maven template, so even those that we've implemented for Python and C require a pom.xml in the repo. We are currently working on a language-agnostic version that will use a standard sonar-project.properties file, and it should be implemented soon (I know that the code is mostly finished, so it may even be ready to go in the next few days, if it doesn't run into any hurdles in review). I'm not sure what the timeline requirements are for implementing this, but all the non-Java projects will probably want to wait until that is ready before implementing scans (if possible)."
Akraino code scan is migrating to use SonarCloud, the following will be removed once the migration is done.
Following configuration assumes SonarQube on prem. As LF is moving to SonarCloud, the setup might be different.
Each project should have jjb file to integrate with CI.
To add SonarQube scan, the jjb file should be modified with the following changes:
Here is an example:
- project:
name: portal_user_interface
project: portal_user_interface
project-name: portal_user_interface
mvn-settings: portal_user_interface-settings
mvn-params: '-f AECPortalMgmt'
nexus-iq-namespace: 'akraino-'
build-node: centos7-builder-2c-1g
stream: master
jobs:
- '{project-name}-maven-jobs'
- gerrit-maven-sonar
views:
- project-view
Currently, global-jjb has jobs for Java/maven, Python/tox, and C/cmake. Other languages will have to create their own job templates. For the supported global-jjb jobs, it's just a matter of including the job (such as "gerrit-maven-sonar"), and any parameters that the job requires, in each project's jjb file.
Here's some additional documentation on the Sonar jobs/macros we have set up:
https://docs.releng.linuxfoundation.org/projects/global-jjb/en/latest/jjb/lf-maven-jobs.html#lf-infra-maven-sonar
https://docs.releng.linuxfoundation.org/projects/global-jjb/en/latest/jjb/lf-python-jobs.html#lf-infra-tox-sonar
https://docs.releng.linuxfoundation.org/projects/global-jjb/en/latest/jjb/lf-c-cpp-jobs.html#cmake-sonar
SonarQube scan results can be accessed from https://sonarcloud.io/organizations/akraino-edge-stack/projects. You should be able to log in with your LFID credentials, the same as you would use for Gerrit or Jenkins.
Bug Severity in SonarQube and mapping to Akraino security requirements
SonarQube | Akraino |
---|---|
Blocker | Critical |
Critical | Important |
Major | Important |
Minor | Moderate |
Info | Low |
Vuls will be integrated with Validation Framework (Bluval User Guide)
Below are the list of tasks for the integration.
Prepare log dir
cd /path/to/working/dir
mkdir go-cve-dictionary-log goval-dictionary-log gost-log
for i in `seq 2002 $(date +"%Y")`; do \ docker run --rm -it \ -v $PWD:/vuls \ -v $PWD/go-cve-dictionary-log:/var/log/vuls \ vuls/go-cve-dictionary fetchnvd -years $i; \ done
docker run --rm -it \ -v $PWD:/vuls \ -v $PWD/goval-dictionary-log:/var/log/vuls \ vuls/goval-dictionary fetch-redhat 5 6 7
docker run --rm -i \ -v $PWD:/vuls \ -v $PWD/goval-log:/var/log/gost \ vuls/gost fetch redhat
[servers]
[servers.c74]
host = "54.249.93.16"
port = "22"
user = "vuls-user"
keyPath = "/root/.ssh/id_rsa" # path to ssh private key in docker
Lynis requires to run on SUT (System Under Test). The overall test framework will the similar to that of Vuls. As to the Lynis installation, there are two options:
Considering the complexity of installing application on target system, it is recommended that option 1 is to be used.