[JBoss JIRA] (JBDS-4237) Generate CVE vulnerability report for devstudio
- First Post
- Replies
- Stats
-
Go to
- ----- 2026 -----
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
[
https://issues.jboss.org/browse/JBDS-4237?page=com.atlassian.jira.plugin....
]
Nick Boldt commented on JBDS-4237:
----------------------------------
Have split the reporting into 6 files (devstudio, central, earlyaccess, and 3x target
platforms) and have generated reports & analysis.
Build is set to yellow (UNSTABLE) because there are 2,112 warnings (539 of them HIGH
priority).
Here's the latest report [1].
And here's a trend chart, which can track how we get better/worse at this, on the
bottom of the job's main page [2]:
!Screenshot_2017-01-10_18-58-03.png|thumbnail!
[1]
https://dev-platform-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/view/All/job...
[2]
https://dev-platform-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/view/All/job...
[~jeffmaury] What would you like to do about these CVE vulnerabilities? Should we pick
some of the HIGH priority ones and try to get them fixed in jbosstools or at eclipse / in
Orbit?
Generate CVE vulnerability report for devstudio
-----------------------------------------------
Key: JBDS-4237
URL: https://issues.jboss.org/browse/JBDS-4237
Project: Red Hat JBoss Developer Studio (devstudio)
Issue Type: Bug
Components: build, versionwatch
Affects Versions: 10.3.0.AM1
Reporter: Nick Boldt
Assignee: Nick Boldt
Fix For: 10.3.0.AM1
Attachments: Screenshot_2017-01-10_18-58-03.png
0. download http://dl.bintray.com/jeremy-long/owasp/dependency-check-1.4.4-release.zip
1. download latest CI build update site zip, target platform zip, central zip, etc.
2. unpack update site zips
3. unpack dep-check zip
4. generate CVE report for each fetched zip:
{code}
./dependency-check.sh --disableAssembly -s /path/to/update-site/plugins/ --project
devstudio_check -o WORKSPACE/path/to/report/folder/
{code}
Could also use https://wiki.jenkins-ci.org/display/JENKINS/OWASP+Dependency-Check+Plugin
for better reporting and maybe even enable this on every project job (once moved to CCI
Jenkins).
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
3372
days inactive
3372
days old
jbosstools-issues@lists.jboss.org
0 comments
1 participants
tags (0)
participants (1)
-
Nick Boldt (JIRA)