DDF-5597 updated dependency-check properties for local NVD by shaundmorris · Pull Request #5654 · codice/ddf

shaundmorris · 2019-12-02T23:32:10Z

What does this PR do?

Allows builds to use local NVD

Who is reviewing it?

@bakejeyner
@AdamBurstynski
@TonyMorrison
@mojogitoverhere
@jordanwilking

Select relevant component teams:

@codice/build
@codice/continuous-integration
@codice/security

Ask 2 committers to review/merge the PR and tag them here.

@oconnormi
@brjeter

How should this be tested?

Any background context you want to provide?

What are the relevant tickets?

Fixes: #5597

Screenshots

Checklist:

Documentation Updated
Update / Add Threat Dragon models
Update / Add Unit Tests
Update / Add Integration Tests

Notes on Review Process

Please see Notes on Review Process for further guidance on requirements for merging and abbreviated reviews.

Review Comment Legend:

✏️ (Pencil) This comment is a nitpick or style suggestion, no action required for approval. This comment should provide a suggestion either as an in line code snippet or a gist.
❓ (Question Mark) This comment is to gain a clearer understanding of design or code choices, clarification is required but action may not be necessary for approval.
❗ (Exclamation Mark) This comment is critical and requires clarification or action before approval.

This change is

shaundmorris · 2019-12-03T15:09:58Z

build now

cxbot · 2019-12-03T15:17:11Z

Internal build has been scheduled, your results will be available at build completion.

brjeter · 2019-12-03T17:03:58Z

                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
-                    <version>${dependency-check-maven.version}</version>


❓ The version is defined in the dependencyManagement section of ddf-parent, right?

Great question. Looks like I made a mistake here, but it still works. I'll put the version back in. It seems like it grabs the latest version of dependency-check (5.2.4) and runs it just fine. There would be a pro to getting the latest, it just wouldn't be stable. Currently we are using 5.2.2 so might be time to upgrade again

cxbot · 2019-12-03T20:02:01Z

Refer to this link for build results (access rights to CI server needed):
https://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/7787/
✅ JOB SUCCESS

shaundmorris · 2019-12-03T23:27:11Z

build now

cxbot · 2019-12-03T23:31:05Z

Internal build has been scheduled, your results will be available at build completion.

cxbot · 2019-12-04T01:56:11Z

Refer to this link for build results (access rights to CI server needed):
https://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/7791/

Build result: FAILURE

[...truncated 11.66 MB...] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:165) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:140) at io.fabric8.maven.docker.access.hc.ApacheHttpClientDelegate.post(ApacheHttpClientDelegate.java:102) at io.fabric8.maven.docker.access.hc.DockerAccessWithHcClient.buildImage(DockerAccessWithHcClient.java:252) ... 40 more[ERROR] [ERROR] Re-run Maven using the -X switch to enable full debug logging.[ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles:[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException[ERROR] [ERROR] After correcting the problems, you can resume the build with the command[ERROR] mvn -rf :ddfchannel stoppedNew run name is 'PR 5654'Taking single-use slave mesos-jenkins-437ccf59-linux-large offline.+ echo ERROR: dockerd exited, or diedERROR: dockerd exited, or died+ sleep 5Archiving artifactsAdding one-line test results to commit status...Setting status of a73f792 to FAILURE with url https://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/7791/ and message: 'JOB FAILURE: https://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/7791/ 14954 tests run, 74 skipped, 0 failed.'Using context: Internal CI Pipeline
❌ JOB FAILURE

shaundmorris · 2019-12-09T16:24:28Z

build now

cxbot · 2019-12-09T16:27:16Z

Internal build has been scheduled, your results will be available at build completion.

cxbot · 2019-12-09T21:06:34Z

Refer to this link for build results (access rights to CI server needed):
https://jenkins.codice.org/job/DDF-Jobs/job/pr/job/Linux/7817/
✅ JOB SUCCESS

* DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version

* DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version (cherry picked from commit 365bfdd)

* Updated Jenkinsfile (#5190) Removed the Xss thread stack size option and added a minimum heap memory option to maven opts (cherry picked from commit e523306) * Increased timeout value to prevent build abortions (need to RCA why builds are taking longer) (cherry picked from commit 68b9232) * DDF-5504 Upgraded to DDF-Parent 1.0.8 and Dependency-Check 5.2.2 (#5510) Cleaned-up dependency-check configuration DDF-5504 Updated dependency-check stage to be more efficient DDF-5504 Updated DDF-Parent and Depdendency-Check DDF-5504 Added dependency-check:aggregate to non-PR builds (cherry picked from commit 0456c03) * DDF-5578 updated codecov stage to be more efficient (#5579) (cherry picked from commit 2e7ec9e) * Archive the dependecy-check aggregate report after the owasp stage finishes. (#5643) (cherry picked from commit 03a3865) * General Jenkinsfile cleanup. (#5666) Moved Codeco.io to be right after the ITests. Removed all the commented windows sections. Removed unneeded parallel sections as well. Added in Commenting onto PR builds using internal library function postCommetnIfPR. (cherry picked from commit efe40ac) * DDF-5597 updated dependency-check properties for local NVD (#5654) * DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version (cherry picked from commit 365bfdd) Co-authored-by: Ryan Zwiefelhofer <rzwiefel@users.noreply.github.com> Co-authored-by: Matthew Bates <matthew.bates@connexta.com> Co-authored-by: Shaun Morris <shaundmorris@users.noreply.github.com>

* DDF-5578 updated codecov stage to be more efficient (#5579) (cherry picked from commit 2e7ec9e) * Archive the dependecy-check aggregate report after the owasp stage finishes. (#5643) (cherry picked from commit 03a3865) * General Jenkinsfile cleanup. (#5666) Moved Codeco.io to be right after the ITests. Removed all the commented windows sections. Removed unneeded parallel sections as well. Added in Commenting onto PR builds using internal library function postCommetnIfPR. (cherry picked from commit efe40ac) * DDF-5597 updated dependency-check properties for local NVD (#5654) * DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version (cherry picked from commit 365bfdd) Co-authored-by: Shaun Morris <shaundmorris@users.noreply.github.com>

* Archive the dependecy-check aggregate report after the owasp stage finishes. (#5643) (cherry picked from commit 03a3865) * Updated Jenkinsfile (#5190) Removed the Xss thread stack size option and added a minimum heap memory option to maven opts (cherry picked from commit e523306) * DDF-5578 updated codecov stage to be more efficient (#5579) (cherry picked from commit 2e7ec9e) * Increased timeout value to prevent build abortions (need to RCA why builds are taking longer) (cherry picked from commit 68b9232) * General Jenkinsfile cleanup. (#5666) Moved Codeco.io to be right after the ITests. Removed all the commented windows sections. Removed unneeded parallel sections as well. Added in Commenting onto PR builds using internal library function postCommetnIfPR. (cherry picked from commit efe40ac) * DDF-5504 Upgraded to DDF-Parent 1.0.8 and Dependency-Check 5.2.2 (#5510) Cleaned-up dependency-check configuration DDF-5504 Updated dependency-check stage to be more efficient DDF-5504 Updated DDF-Parent and Depdendency-Check DDF-5504 Added dependency-check:aggregate to non-PR builds (cherry picked from commit 0456c03) (cherry picked from commit 6a48ac2) * DDF-5597 updated dependency-check properties for local NVD (#5654) * DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version (cherry picked from commit 365bfdd) Co-authored-by: Ryan Zwiefelhofer <rzwiefel@users.noreply.github.com> Co-authored-by: Shaun Morris <shaundmorris@users.noreply.github.com> Co-authored-by: Matthew Bates <matthew.bates@connexta.com>

* DDF-5504 Upgraded to DDF-Parent 1.0.8 and Dependency-Check 5.2.2 (#5510) Cleaned-up dependency-check configuration DDF-5504 Updated dependency-check stage to be more efficient DDF-5504 Updated DDF-Parent and Depdendency-Check DDF-5504 Added dependency-check:aggregate to non-PR builds (cherry picked from commit 0456c03) * DDF-5578 updated codecov stage to be more efficient (#5579) (cherry picked from commit 2e7ec9e) * Increased timeout value to prevent build abortions (need to RCA why builds are taking longer) (cherry picked from commit 68b9232) * Archive the dependecy-check aggregate report after the owasp stage finishes. (#5643) (cherry picked from commit 03a3865) * General Jenkinsfile cleanup. (#5666) Moved Codeco.io to be right after the ITests. Removed all the commented windows sections. Removed unneeded parallel sections as well. Added in Commenting onto PR builds using internal library function postCommetnIfPR. (cherry picked from commit efe40ac) * DDF-5597 updated dependency-check properties for local NVD (#5654) * DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version (cherry picked from commit 365bfdd) Co-authored-by: Shaun Morris <shaundmorris@users.noreply.github.com> Co-authored-by: Matthew Bates <matthew.bates@connexta.com>

…5725) * DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version

DDF-5597 updated dependency-check properties

deb28d5

brjeter approved these changes Dec 3, 2019

View reviewed changes

LinkMJB approved these changes Dec 3, 2019

View reviewed changes

DDF-5597 added back dependency-check maven version

a73f792

shaundmorris merged commit 365bfdd into codice:master Dec 19, 2019

shaundmorris deleted the DDF-5597 branch December 19, 2019 22:48

shaundmorris added a commit to shaundmorris/ddf that referenced this pull request Dec 19, 2019

DDF-5597 updated dependency-check properties for local NVD (codice#5654)

bfff3fe

* DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version

jlcsmith added this to the 2.22.0 milestone Jan 30, 2020

LinkMJB pushed a commit that referenced this pull request Mar 19, 2020

DDF-5597 updated dependency-check properties for local NVD (#5654) (#…

9ca1159

…5725) * DDF-5597 updated dependency-check properties * DDF-5597 added back dependency-check maven version

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DDF-5597 updated dependency-check properties for local NVD#5654

DDF-5597 updated dependency-check properties for local NVD#5654
shaundmorris merged 2 commits into
codice:masterfrom
shaundmorris:DDF-5597

shaundmorris commented Dec 2, 2019 •

edited

Loading

Uh oh!

shaundmorris commented Dec 3, 2019

Uh oh!

cxbot commented Dec 3, 2019

Uh oh!

brjeter Dec 3, 2019

Uh oh!

shaundmorris Dec 3, 2019

Uh oh!

cxbot commented Dec 3, 2019

Uh oh!

shaundmorris commented Dec 3, 2019

Uh oh!

cxbot commented Dec 3, 2019

Uh oh!

cxbot commented Dec 4, 2019

Uh oh!

shaundmorris commented Dec 9, 2019

Uh oh!

cxbot commented Dec 9, 2019

Uh oh!

cxbot commented Dec 9, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

shaundmorris commented Dec 2, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Who is reviewing it?

Select relevant component teams:

Ask 2 committers to review/merge the PR and tag them here.

How should this be tested?

Any background context you want to provide?

What are the relevant tickets?

Screenshots

Checklist:

Notes on Review Process

Review Comment Legend:

Uh oh!

shaundmorris commented Dec 3, 2019

Uh oh!

cxbot commented Dec 3, 2019

Uh oh!

brjeter Dec 3, 2019

Choose a reason for hiding this comment

Uh oh!

shaundmorris Dec 3, 2019

Choose a reason for hiding this comment

Uh oh!

cxbot commented Dec 3, 2019

Uh oh!

shaundmorris commented Dec 3, 2019

Uh oh!

cxbot commented Dec 3, 2019

Uh oh!

cxbot commented Dec 4, 2019

Build result: FAILURE

Uh oh!

shaundmorris commented Dec 9, 2019

Uh oh!

cxbot commented Dec 9, 2019

Uh oh!

cxbot commented Dec 9, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

shaundmorris commented Dec 2, 2019 •

edited

Loading