Skip to content

Commit 4d52a0e

Browse files
ystefinkoystefinko
authored
Add job/scripts for security scan (#717)
Job should run weekly on Gitlab by Schedule. Script doing: - build on centos7 with debug - upload archive into Security scanner via API Relates-to: OLPEDGE-896 Signed-off-by: Yaroslav Stefinko <[email protected]>
1 parent cb9aca6 commit 4d52a0e

File tree

3 files changed

+189
-0
lines changed

3 files changed

+189
-0
lines changed

‎.gitlab-ci.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,26 @@ stages:
1010
- translate_report
1111
- deploy
1212

13+
wv_security_job:
14+
stage: test
15+
tags:
16+
- docker-prod
17+
image: ${DOCKER_REGISTRY}/${DOCKER_IMAGE_SECURITY}:${DOCKER_IMAGE_SECURITY_VERSION}
18+
script:
19+
- $CI_PROJECT_DIR/scripts/linux/weekly/build_centos_debug_wv.sh --centos
20+
- $CI_PROJECT_DIR/scripts/linux/weekly/security_scanner_upload_wv.sh build/binaries.tar.gz [email protected]
21+
only:
22+
refs:
23+
- master
24+
- schedules
25+
variables:
26+
- $SECURITY
27+
artifacts:
28+
when: always
29+
paths:
30+
- build/binaries.tar.gz
31+
expire_in: 1 year # save our archive for 1 year as job artifacts
32+
1333
build_linux_armhf_fv:
1434
stage: build
1535
tags:

‎scripts/linux/weekly/build_centos_debug_wv.sh‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/bin/bash -ex
2+
#
3+
# Copyright (C) 2020 HERE Europe B.V.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
# License-Filename: LICENSE
19+
20+
#
21+
# Special build in debug, to be build in special docker images: Centos gcc 7.3
22+
#
23+
24+
# Set workspace location
25+
if [[ ${WORKSPACE} == "" ]]; then
26+
export WORKSPACE=`pwd`
27+
fi
28+
# Add all needed variables
29+
export BUILD_DIR_NAME="build"
30+
export BUILD_DIR="$WORKSPACE/$BUILD_DIR_NAME"
31+
export ARCHIVE_FILE_NAME="binaries.tar.gz" # artifact name is defined by CI so please do not rename it
32+
export BUILD_ZIP=1 # always build artifacts
33+
34+
export CMAKE_CXX_FLAGS="-march=x86-64 -gdwarf-2 -g3 -O0 -fno-builtin"
35+
export CMAKE_C_FLAGS="-march=x86-64 -gdwarf-2 -g3 -O0 -fno-builtin"
36+
37+
# Add more parameters into CMAKE_PARAM below when needed
38+
export FLAVOR="Debug"
39+
export CMAKE_PARAM="-DCMAKE_CXX_FLAGS=\"${CMAKE_CXX_FLAGS}\" -DCMAKE_C_FLAGS=\"${CMAKE_C_FLAGS}\" -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=$FLAVOR -DOLP_SDK_BUILD_EXAMPLES=ON"
40+
export CMAKE_COMMAND="cmake ${CMAKE_PARAM} .."
41+
export CMAKE_BUILD_ALL_TARGETS="cmake --build . -- -j8"
42+
43+
# Function :
44+
build_for_centos() {
45+
echo ""
46+
echo ""
47+
echo "*************** $VARIANT Build EDGE SDK CPP ********** Start ***************"
48+
# Show initial ccache data
49+
ccache -s
50+
echo ""
51+
echo " ---- Calling ${CMAKE_COMMAND}"
52+
eval "${CMAKE_COMMAND}"
53+
54+
# Run CMake. Warnings and errors are saved to build/CMakeFiles/CMakeOutput.log and
55+
# build/CMakeFiles/CMakeError.log.
56+
# -- We link Edge SDK as shared libraries in order to use shadowing for unit tests.
57+
# -- We build the examples.
58+
echo ""
59+
echo " ---- Calling ${CMAKE_BUILD_ALL_TARGETS}"
60+
${CMAKE_BUILD_ALL_TARGETS}
61+
62+
cd ${WORKSPACE}
63+
64+
if [[ ${BUILD_ZIP} -eq 1 ]]; then
65+
echo "Zipping up artifacts needed for testing ..."
66+
67+
# Prepare artifacts archive for test job
68+
# Zip up all the binaries needed to run the tests but need to leave the tar.gz file in build
69+
# folder as this ensure the CI system archives it automatically
70+
tar -czf "${BUILD_DIR_NAME}/$ARCHIVE_FILE_NAME" --exclude='*.git' \
71+
"${BUILD_DIR_NAME}/olp-*/*.so"
72+
# List files in build archive
73+
tar -tvf "${BUILD_DIR_NAME}/$ARCHIVE_FILE_NAME"
74+
fi
75+
echo ""
76+
echo ""
77+
echo "*************** $VARIANT Build EDGE SDK CPP ********** Done ***************"
78+
}
79+
80+
while [[ $# -gt 0 ]]; do
81+
key="$1"
82+
case "$key" in
83+
-c|--centos)
84+
BUILD_VARIANT=1
85+
VARIANT="Centos"
86+
;;
87+
esac
88+
# Shift after checking all the cases to get the next option
89+
shift
90+
done
91+
92+
if [[ -d ${BUILD_DIR} ]]; then
93+
rm -rf ${BUILD_DIR}
94+
fi
95+
mkdir -p ${BUILD_DIR}
96+
97+
echo ""
98+
echo "*************** Build Started ***************"
99+
echo "WORKSPACE: $WORKSPACE"
100+
echo "BUILD DIR: $BUILD_DIR"
101+
echo "FLAVOR: $FLAVOR"
102+
echo "VARIANT: $VARIANT"
103+
echo ""
104+
echo ""
105+
106+
# Goto build folder
107+
cd "$BUILD_DIR"
108+
109+
case "$BUILD_VARIANT" in
110+
1)
111+
build_for_centos
112+
;;
113+
esac
114+
echo ""
115+
echo ""
116+
echo "*************** Build Done ***************"
117+

‎scripts/linux/weekly/security_scanner_upload_wv.sh‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash -ex
2+
#
3+
# Copyright (C) 2020 HERE Europe B.V.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
# License-Filename: LICENSE
19+
#
20+
###### Script for packaging and uploading to Security Scanner for security test. Mandatory for Security review.
21+
#
22+
# Required variables:
23+
# SECURITY_API_PWD, SECURITY_API_USER, SECURITY_SCANNER, SECURITY_API_URL .
24+
# note that below hardcoded is number 454830 : CPP SDK app ID in Security Scanner .
25+
#
26+
# SDK Usage:
27+
# SecurityScannerUpload.sh build/binaries.tar.gz [email protected] # any mail can be specified
28+
#
29+
###### Usage from official Security Scanner API documentation :
30+
# SecurityScannerUpload.sh <filname> <email> <application-id> <label>
31+
# Examples:
32+
# SecurityScannerUpload.sh /tmp/app.war [email protected] 443849 1.0.0-RC1
33+
#
34+
set +e
35+
LATEST_TAG=$(git describe --abbrev=0 --tags) || LATEST_TAG=$(git describe --abbrev=0 --tags --always)
36+
LATEST_HASH=$(git rev-parse --short=7 HEAD)
37+
set -e
38+
echo "##############################"
39+
echo "LATEST_TAG is ${LATEST_TAG}"
40+
echo "##############################"
41+
echo "LATEST_HASH is ${LATEST_HASH}"
42+
echo "##############################"
43+
44+
# Check packing all files for further scan, skip tests and git files.
45+
tar -tvf build/binaries.tar.gz
46+
47+
echo "Packed file: $1. Uploading it..."
48+
49+
curl -f -v -k -H"X-spc-${SECURITY_SCANNER}-username:${SECURITY_API_USER}" -H"X-spc-${SECURITY_SCANNER}-password:${SECURITY_API_PWD}" \
50+
-H"X-spc-${SECURITY_SCANNER}-email:$2" -F"file=@$1" https://${SECURITY_API_URL}/${SECURITY_SCANNER}-ws/analysis/start/454830/version/edge-sdk-cpp-${LATEST_HASH}
51+
52+
echo "File $1 was uploaded to Security Scanner via API"

0 commit comments

Comments
 (0)