Dotnet Vulnerability scanner | cakebuild

A CakeBuild plugin to scan a dotnet project/solution dependecies for vulneraiblties using Sonatype OssIndex | https://ossindex.sonatype.org/

Usage

The plugin could be used as cakebuild script plugin or cake frosting task.

Cake script

1. Add the plugin to your cake script :

#addin nuget:?package=Cake.VulnerabilityScanner&version=[specify the version here]

https://github.com/RapidFailure/cake-dotnet-vulnerability-scanner/blob/6b69ae9b3f34ebddf0b483c01cbfa9973bc0694d/demo/cake/build.cake#L2

2. Add a task

Task("ScanPackages") 
    .Does( async () =>
{
            var ossIndexToken = Environment.GetEnvironmentVariable("OSS_INDEX_TOKEN");
            await  ScanPackagesAsync(new ScanPackagesSettings
            {
                Ecosystem="nuget",
                FailOnVulnerability=false,
                OssIndexBaseUrl="https://ossindex.sonatype.org/",
                OssIndexToken=ossIndexToken,
                SolutionFile="../../Cake.VulnerabilityScanner.sln",
                Verbosity= Microsoft.Extensions.Logging.LogLevel.Debug
            }, System.Threading.CancellationToken.None);
});

https://github.com/RapidFailure/cake-dotnet-vulnerability-scanner/blob/6b69ae9b3f34ebddf0b483c01cbfa9973bc0694d/demo/cake/build.cake#L12-L26

Cake Frosting

1. Install the pacakge

dotnet add package Cake.VulnerabilityScanner --version 0.3.0

2. add the task as following

    [TaskName("scan pacakges")]
    public sealed class ScanPackagesTask : AsyncFrostingTask<FrostingContext>
    {
        public override async Task RunAsync(FrostingContext context)
        {
            // SonaType token,  base64 username:password
            var ossIndexToken = context.Environment.GetEnvironmentVariable("OSS_INDEX_TOKEN");
            await context.ScanPackagesAsync(new ScanPackagesSettings
            {
                Ecosystem="nuget",
                FailOnVulnerability=true,
                OssIndexBaseUrl="https://ossindex.sonatype.org/",
                OssIndexToken=ossIndexToken,
                SolutionFile="../../../../../Cake.VulnerabilityScanner.sln",
                Verbosity= Microsoft.Extensions.Logging.LogLevel.Debug
            }, CancellationToken.None);
        }
    }

https://github.com/RapidFailure/cake-dotnet-vulnerability-scanner/blob/2bbf524dd0b39af05256452502128f340c61a5a4/demo/frosting/Program.cs#L18-L35

License

This project is licensed under the MIT License - see the LICENSE file for details.