Skip to content

Commit 520749e

Browse files
dschwartz-ftadvisorydschwartz-ftadvisory
committed
FINOS - CVE and OpenSSF changes
1 parent 477a9cb commit 520749e

File tree

3 files changed

+138
-132
lines changed

3 files changed

+138
-132
lines changed

‎README.md‎

Lines changed: 56 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@
66

77
This repository creates a generator that will produce Python from a model developed using [Rune](https://github.com/finos/rune-dsl). The generated Python relies upon the [RunePythonRuntime]() library.
88

9-
The generator supports creation of Python for the full Rune type syntax, and, as described in [EXPRESSION_SUPPORT.md](./EXPRESSION_SUPPORT.md), expression coverage is comprehensive. The generator does not yet fully implement function generation.
9+
**Continuous Integration:**
10+
11+
*Rune Python Generator* - the generator supports creation of Python for the full Rune type syntax, and, as described in [EXPRESSION_SUPPORT.md](./EXPRESSION_SUPPORT.md), expression coverage is comprehensive. The generator does not yet fully implement function generation.
1012

1113
The Python package requires Python version 3.11+.
1214

@@ -21,19 +23,50 @@ The Python package requires Python version 3.11+.
2123
- `build/build_cdm.sh` - used to create a Python package from code generated using CDM Rune definitions
2224
- `test` - Python unit tests and scripts to run the tests
2325

24-
## Installation Steps
26+
## Development setup
27+
28+
### Setup for developers
29+
This guide is meant for everyone who wants to contribute to the Rune Pyhton Generator and needs to get things up and running.
30+
2531
Detailed build and testing instructions can be found in [BUILDANDTEST.md](./BUILDANDTEST.md)
2632

27-
A quick overview follows:
33+
If this guide does not work for you, be sure to raise an issue. This way we can help you figure out what the problem is and update this guide to prevent the same problem for future users.
34+
35+
### 1. Building with Maven
36+
Start by cloning the project: `git clone https://github.com/regnosys/rune-python-generator`
37+
38+
Our project runs with Java 21. Make sure that your Maven also uses this version of Java by running `mvn -v`.
39+
40+
To build the project, run `mvn clean install`.
2841

29-
1. Make a local copy of this repo
30-
2. Build and test using Maven
31-
```
32-
cd rune-python-generator
33-
mvn -s clean install
34-
```
3542
All the tests should pass.
3643

44+
### 2. Setting things up in Eclipse
45+
#### Install Eclipse IDE for Java and DSL Developers
46+
Install version `2025-06` of the "Eclipse IDE for Java and DSL Developers" using the [Eclipse Installer](https://www.eclipse.org/downloads/packages/installer). You might have to enable "Advanced Mode" in the settings of the Eclipse Installer to install a specific version.
47+
48+
#### Configure Eclipse with the right version of Java
49+
Xtend files cannot be build with any Java version later than 21. In Eclipse, go to Settings... > Java > Installed JREs and make sure the checked JRE points to a Java version of 21.
50+
51+
#### Install the Checkstyle plugin
52+
We use [Checkstyle](https://checkstyle.sourceforge.io/) for enforcing good coding practices. The Eclipse plugin for Checkstyle can be found here: [https://checkstyle.org/eclipse-cs/#!/](https://checkstyle.org/eclipse-cs/#!/).
53+
54+
#### Open the project in Eclipse
55+
Go to Import... > Existing Maven Project, select the right folder, click Finish.
56+
57+
### To Generate CDM from Rune
58+
59+
Use this script to generated the Python version of CDM
60+
```sh
61+
build/build_cdm.sh
62+
```
63+
The script will use the CDM from the branch specified in the file (E.G. master) of the [FINOS Repo](https://github.com/finos/common-domain-model) and generate a wheel in the project directory `target/python-cdm`
64+
65+
To use a different version of CDM, update CDM_VERSION in the script.
66+
67+
## Roadmap
68+
69+
The roadmap follows the roadmap for the [Rune-DSL](https://github.com/finos/rune-dsl/)
3770

3871
## Contributing
3972
For any questions, bugs or feature requests please open an [issue](https://github.com/regnosys/rune-python-generator/issues)
@@ -47,20 +80,15 @@ To submit a contribution:
4780
5. Push to the branch (`git push origin feature/fooBar`)
4881
6. Create a new Pull Request
4982

50-
# To Generate CDM from Rune
83+
_NOTE:_ Commits and pull requests to FINOS repositories will only be accepted from those contributors with an active, executed Individual Contributor License Agreement (ICLA) with FINOS OR who are covered under an existing and active Corporate Contribution License Agreement (CCLA) executed with FINOS. Commits from individuals not covered under an ICLA or CCLA will be flagged and blocked by the FINOS Clabot tool (or EasyCLA). Please note that some CCLAs require individuals/employees to be explicitly named on the CCLA.
5184

52-
Use this script to generated the Python version of CDM
53-
```sh
54-
build/build_cdm.sh
55-
```
56-
The script will use the CDM from the branch specified in the file (E.G. master) of the [FINOS Repo](https://github.com/finos/common-domain-model) and generate a wheel in the project directory `target/python-cdm`
85+
Unsure if you are covered under an existing CCLA? Email [email protected]*
5786

58-
To use a different version of CDM, update CDM_VERSION in the script.
87+
## Get in touch with the Rune Python Generator Team
5988

60-
## Contributors
61-
- [CLOUDRISK Limited](https://www.cloudrisk.uk), email: [email protected]
62-
- [FT Advisory LLC](https://www.ftadvisory.co), email: [email protected]
63-
- [TradeHeader SL](https://www.tradeheader.com), email: [email protected]
89+
Get in touch with the Rune team by creating a [GitHub issue](https://github.com/REGnosys/rune-python-dsl/issues/new) and labelling it with "help wanted".
90+
91+
We encourage the community to get in touch via the [FINOS Slack](https://www.finos.org/blog/finos-announces-new-community-slack).
6492

6593
## Governance
6694

@@ -73,3 +101,11 @@ Copyright 2023-2025 CLOUDRISK Limited and FT Advisory LLC
73101
Distributed under the [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0).
74102

75103
SPDX-License-Identifier: [Apache-2.0](https://spdx.org/licenses/Apache-2.0)
104+
105+
## Contributors
106+
107+
- [CLOUDRISK Limited](https://www.cloudrisk.uk), email: [email protected]
108+
- [FT Advisory LLC](https://www.ftadvisory.co), email: [email protected]
109+
- [TradeHeader SL](https://www.tradeheader.com), email: [email protected]
110+
111+
SPDX-License-Identifier: [Apache-2.0](https://spdx.org/licenses/Apache-2.0)

‎allow-list.xml‎

Lines changed: 79 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -1,112 +1,82 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3-
<suppress>
4-
<notes><![CDATA[
5-
Testing false positives by suppressing a CVE
6-
]]></notes>
7-
<filePath regex="true">.*\bsample-project-0\.0\.1\.jar/META-INF/maven/commons-fileupload/commons-fileupload/pom\.xml</filePath>
8-
<cve>CVE-2023-24998</cve>
9-
<cve>CVE-2016-3092</cve>
10-
<cve>CVE-2016-1000031</cve>
11-
<cve>CVE-2014-0050</cve>
12-
<cve>CVE-2013-2186</cve>
13-
</suppress>
14-
15-
<suppress>
16-
<notes><![CDATA[
17-
Testing false positives by suppressing a CVE
18-
]]></notes>
19-
<filePath regex="true">.*\bsample-project-0\.0\.1\.jar/META-INF/maven/commons-io/commons-io/pom\.xml</filePath>
20-
<cve>CVE-2021-29425</cve>
21-
</suppress>
22-
23-
<suppress>
24-
<notes><![CDATA[
25-
Testing false positives by suppressing a CVE
26-
]]></notes>
27-
<filePath regex="true">.*\bsample-project-0\.0\.1\.jar/META-INF/maven/org\.apache\.struts\.xwork/xwork-core/pom\.xml</filePath>
28-
<cve>CVE-2013-1966</cve>
29-
<cve>CVE-2016-4461</cve>
30-
<cve>CVE-2013-1965</cve>
31-
<cve>CVE-2016-2162</cve>
32-
<cve>CVE-2013-2115</cve>
33-
<cve>CVE-2014-0112</cve>
34-
<cve>CVE-2019-0233</cve>
35-
<cve>CVE-2017-9787</cve>
36-
</suppress>
37-
38-
<suppress>
39-
<notes><![CDATA[
40-
Testing false positives by suppressing a CVE
41-
]]></notes>
42-
<filePath regex="true">.*\bsample-project-0\.0\.1\.jar/META-INF/maven/ognl/ognl/pom\.xml</filePath>
43-
<cve>CVE-2016-3093</cve>
44-
</suppress>
2+
<!--
3+
~ Copyright 2025 CLOUDRISK and FT Advisory LLC
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ http://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
4517

46-
<suppress>
47-
<notes><![CDATA[
48-
Testing false positives by suppressing a CVE
49-
]]></notes>
50-
<filePath regex="true">.*\bsample-project-0.0.1.jar/META-INF/maven/org.apache.struts/struts2-core/pom.xml</filePath>
51-
<cve>CVE-2016-4461</cve>
52-
<cve>CVE-2015-5209</cve>
53-
<cve>CVE-2016-2162</cve>
54-
<cve>CVE-2018-1327</cve>
55-
<cve>CVE-2012-0394</cve>
56-
<cve>CVE-2015-2992</cve>
57-
<cve>CVE-2016-3093</cve>
58-
<cve>CVE-2023-34396</cve>
59-
<cve>CVE-2016-0785</cve>
60-
<cve>CVE-2016-4003</cve>
61-
<cve>CVE-2013-2248</cve>
62-
<cve>CVE-2017-5638</cve>
63-
<cve>CVE-2015-5169</cve>
64-
<cve>CVE-2017-9793</cve>
65-
<cve>CVE-2016-4430</cve>
66-
<cve>CVE-2017-9791</cve>
67-
<cve>CVE-2016-3081</cve>
68-
<cve>CVE-2016-3082</cve>
69-
<cve>CVE-2023-34149</cve>
70-
<cve>CVE-2019-0230</cve>
71-
<cve>CVE-2013-2134</cve>
72-
<cve>CVE-2016-4436</cve>
73-
<cve>CVE-2019-0233</cve>
74-
<cve>CVE-2021-31805</cve>
75-
<cve>CVE-2014-7809</cve>
76-
<cve>CVE-2013-2135</cve>
77-
<cve>CVE-2014-0116</cve>
78-
<cve>CVE-2013-2251</cve>
79-
<cve>CVE-2013-4310</cve>
80-
<cve>CVE-2013-1966</cve>
81-
<cve>CVE-2017-9804</cve>
82-
<cve>CVE-2013-1965</cve>
83-
<cve>CVE-2017-9805</cve>
84-
<cve>CVE-2017-12611</cve>
85-
<cve>CVE-2013-2115</cve>
86-
<cve>CVE-2014-0113</cve>
87-
<cve>CVE-2013-4316</cve>
88-
<cve>CVE-2014-0112</cve>
89-
<cve>CVE-2018-11776</cve>
90-
<cve>CVE-2016-3090</cve>
91-
<cve>CVE-2017-9787</cve>
92-
<cve>CVE-2014-0094</cve>
93-
<cve>CVE-2020-17530</cve>
94-
</suppress>
95-
96-
<suppress>
97-
<notes><![CDATA[
98-
file name: sample-project-0.0.1.jar (shaded: commons-fileupload:commons-fileupload:1.2.2)
99-
]]></notes>
100-
<packageUrl regex="true">^pkg:maven/commons\-fileupload/commons\-fileupload@.*$</packageUrl>
101-
<cve>CVE-2013-0248</cve>
102-
</suppress>
103-
104-
<suppress>
105-
<notes><![CDATA[
106-
file name: sample-project-0.0.1.jar (shaded: org.apache.struts:struts2-core:2.3.8)
107-
]]></notes>
108-
<packageUrl regex="true">^pkg:maven/org\.apache\.struts/struts2\-core@.*$</packageUrl>
109-
<cve>CVE-2023-50164</cve>
110-
<cve>CVE-2023-41835</cve>
111-
</suppress>
18+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
19+
<suppress>
20+
<notes><![CDATA[
21+
This CVE only affects projects fetching p2 repo's over HTTP, but we use HTTPS.
22+
]]></notes>
23+
<cve>CVE-2021-41033</cve>
24+
</suppress>
25+
<suppress>
26+
<notes><![CDATA[
27+
We are using Reload4j, which is a secure drop-in replacement for log4j.
28+
]]></notes>
29+
<cve>CVE-2020-9493</cve>
30+
</suppress>
31+
<suppress>
32+
<notes><![CDATA[
33+
We are using Reload4j, which is a secure drop-in replacement for log4j.
34+
]]></notes>
35+
<cve>CVE-2022-23307</cve>
36+
</suppress>
37+
<suppress>
38+
<notes><![CDATA[
39+
This CVE is not about org.junit.platform.commons. It seems the check is
40+
too loose.
41+
]]></notes>
42+
<cve>CVE-2020-27225</cve>
43+
</suppress>
44+
<suppress>
45+
<notes><![CDATA[
46+
This CVE only affects projects using Xtext prior to 2.18.0.
47+
]]></notes>
48+
<cve>CVE-2019-10249</cve>
49+
</suppress>
50+
<suppress>
51+
<notes><![CDATA[
52+
Calling the method `com.google.common.io.Files.createTempDir` is a vulnerability,
53+
but we do not call it.
54+
]]></notes>
55+
<cve>CVE-2020-8908</cve>
56+
</suppress>
57+
<suppress>
58+
<notes><![CDATA[
59+
We are not creating SVG's with Batik of Apache XML Graphics.
60+
]]></notes>
61+
<cve>CVE-2022-41704</cve>
62+
</suppress>
63+
<suppress>
64+
<notes><![CDATA[
65+
We are not creating SVG's with Batik of Apache XML Graphics.
66+
]]></notes>
67+
<cve>CVE-2022-42890</cve>
68+
</suppress>
69+
<suppress>
70+
<notes><![CDATA[
71+
This CVE is not about org.eclipse.e4.emf.xpath. It seems the check is
72+
too loose.
73+
]]></notes>
74+
<cve>CVE-2022-41852</cve>
75+
</suppress>
76+
<suppress>
77+
<notes><![CDATA[
78+
This only affects milestone and RC versions, but we use a stable release.
79+
]]></notes>
80+
<cve>CVE-2020-15824</cve>
81+
</suppress>
11282
</suppressions>

‎pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@
154154

155155
<apache.commons.lang.version>3.13.0</apache.commons.lang.version>
156156
<apache.commons.text.version>1.11.0</apache.commons.text.version>
157-
<commons-io.version>2.11.0</commons-io.version>
157+
<commons-io.version>2.19.0</commons-io.version>
158158
<guava.version>32.0.1-jre</guava.version>
159159

160160
<!-- Release -->
@@ -389,12 +389,12 @@
389389
<dependency>
390390
<groupId>org.apache.maven</groupId>
391391
<artifactId>maven-model</artifactId>
392-
<version>3.3.9</version>
392+
<version>3.9.10</version>
393393
</dependency>
394394
<dependency>
395395
<groupId>org.apache.commons</groupId>
396396
<artifactId>commons-configuration2</artifactId>
397-
<version>2.8.0</version>
397+
<version>2.12.0</version>
398398
</dependency>
399399
<!-- migrated from Python POM: end -->
400400
</dependencies>

0 commit comments

Comments
 (0)