Skip to content

Commit 4bca2a8

Browse files
mcasimirmcasimir
authored
chore: integrate sbom-tools MONGOSH-1450, MONGOSH-1451 (#1466)
* chore: integrate sbom-tools MONGOSH-1450 * revert unwanted changes * scan node with nist.gov * integrate vuln check in CI * upload with signed visibility * update dep version * fix generate notices * also upload THIRD_PARTY_NOTICES.md * update-third-party-notices
1 parent 4235dff commit 4bca2a8

File tree

11 files changed

+2397
-7420
lines changed

11 files changed

+2397
-7420
lines changed

‎.evergreen.yml‎

Lines changed: 106 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ post:
3535
# test_linux_artifact - Test that the built artifact works where we expect it to.
3636
# We use this to verify that e.g. the Ubuntu-built release
3737
# binary also works on RHEL and Debian.
38+
# generate_license_and_vulnerability_report - Generates a report of vulnerabilities affecting the bundled application.
3839
# release_publish - Publishes the npm packages and uploads the tarballs.
3940
functions:
4041
checkout:
@@ -5813,6 +5814,88 @@ functions:
58135814
./usr/bin/mongosh --smokeTests
58145815
}
58155816
5817+
generate_license_and_vulnerability_report:
5818+
- command: expansions.write
5819+
params:
5820+
file: tmp/expansions.yaml
5821+
redacted: true
5822+
- command: shell.exec
5823+
params:
5824+
working_dir: src
5825+
shell: bash
5826+
env:
5827+
NODE_JS_VERSION: ${node_js_version}
5828+
EVERGREEN_IS_PATCH: ${is_patch}
5829+
SNYK_TOKEN: ${snyk_token}
5830+
script: |
5831+
set -e
5832+
export NODE_JS_VERSION=${node_js_version}
5833+
source .evergreen/setup-env.sh
5834+
5835+
# validate licenses, we first remove THIRD_PARTY_NOTICES.md, so we are sure
5836+
# that we would only upload the newly generated file in case of success.
5837+
rm THIRD_PARTY_NOTICES.md
5838+
npm run update-third-party-notices
5839+
5840+
# generate vulnerability report: can only fail if is not a patch.
5841+
npm run generate-vulnerability-report || { [ "$EVERGREEN_IS_PATCH" == "true" ] && exit 0; } || exit 1
5842+
5843+
- command: s3.put
5844+
params:
5845+
aws_key: ${aws_key}
5846+
aws_secret: ${aws_secret}
5847+
bucket: mciuploads
5848+
permissions: private
5849+
visibility: signed
5850+
local_file: src/.sbom/dependencies.json
5851+
remote_file: ${project}/${revision}_${revision_order_id}/dependencies.json
5852+
content_type: application/json
5853+
optional: true
5854+
- command: s3.put
5855+
params:
5856+
aws_key: ${aws_key}
5857+
aws_secret: ${aws_secret}
5858+
bucket: mciuploads
5859+
permissions: private
5860+
visibility: signed
5861+
local_file: src/.sbom/snyk-test-result.json
5862+
remote_file: ${project}/${revision}_${revision_order_id}/snyk-test-result.json
5863+
content_type: application/json
5864+
optional: true
5865+
- command: s3.put
5866+
params:
5867+
aws_key: ${aws_key}
5868+
aws_secret: ${aws_secret}
5869+
bucket: mciuploads
5870+
permissions: private
5871+
visibility: signed
5872+
local_file: src/.sbom/snyk-test-result.html
5873+
remote_file: ${project}/${revision}_${revision_order_id}/snyk-test-result.html
5874+
content_type: text/html
5875+
optional: true
5876+
- command: s3.put
5877+
params:
5878+
aws_key: ${aws_key}
5879+
aws_secret: ${aws_secret}
5880+
bucket: mciuploads
5881+
permissions: private
5882+
visibility: signed
5883+
local_file: src/.sbom/vulnerability-report.md
5884+
remote_file: ${project}/${revision}_${revision_order_id}/vulnerability-report.md
5885+
content_type: text/markdown
5886+
optional: true
5887+
- command: s3.put
5888+
params:
5889+
aws_key: ${aws_key}
5890+
aws_secret: ${aws_secret}
5891+
bucket: mciuploads
5892+
permissions: private
5893+
visibility: signed
5894+
local_file: src/THIRD_PARTY_NOTICES.md
5895+
remote_file: ${project}/${revision}_${revision_order_id}/THIRD_PARTY_NOTICES.md
5896+
content_type: text/markdown
5897+
optional: true
5898+
58165899
release_draft:
58175900
- command: expansions.write
58185901
params:
@@ -5884,6 +5967,7 @@ functions:
58845967
# package_and_upload_artifact - Upload the release binary to S3.
58855968
# test_linux_artifact - Test that the built artifact works where we expect it to.
58865969
# release_publish - Publishes the npm packages and uploads the tarballs.
5970+
# generate_license_and_vulnerability_report - Generates a report of vulnerabilities affecting the bundled application.
58875971
# pkg_test_* - Run tests on the release packages
58885972
tasks:
58895973
- name: compile_ts
@@ -8962,11 +9046,11 @@ tasks:
89629046
- func: checkout
89639047
- func: install
89649048
vars:
8965-
node_js_version: "14.21.3"
9049+
node_js_version: "16.19.1"
89669050
npm_deps_mode: all
89679051
- func: test_vscode
89689052
vars:
8969-
node_js_version: "14.21.3"
9053+
node_js_version: "16.19.1"
89709054
- name: test_connectivity
89719055
tags: ["extra-integration-test"]
89729056
depends_on:
@@ -9009,6 +9093,20 @@ tasks:
90099093
vars:
90109094
node_js_version: "16.19.1"
90119095

9096+
- name: generate_license_and_vulnerability_report
9097+
depends_on:
9098+
- name: compile_ts
9099+
variant: linux_unit
9100+
commands:
9101+
- func: checkout
9102+
- func: install
9103+
vars:
9104+
node_js_version: "16.19.1"
9105+
npm_deps_mode: cli_build
9106+
- func: generate_license_and_vulnerability_report
9107+
vars:
9108+
node_js_version: "16.19.1"
9109+
90129110
###
90139111
# E2E TESTS
90149112
###
@@ -11939,3 +12037,9 @@ buildvariants:
1193912037
- name: release_draft
1194012038
- name: release_publish_dry_run
1194112039
- name: release_publish
12040+
12041+
- name: generate_license_and_vulnerability_report
12042+
display_name: "License and Vulnerability Report"
12043+
run_on: ubuntu2004-small
12044+
tasks:
12045+
- name: generate_license_and_vulnerability_report

‎.evergreen/evergreen.yml.in‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ post:
9595
# test_linux_artifact - Test that the built artifact works where we expect it to.
9696
# We use this to verify that e.g. the Ubuntu-built release
9797
# binary also works on RHEL and Debian.
98+
# generate_license_and_vulnerability_report - Generates a report of vulnerabilities affecting the bundled application.
9899
# release_publish - Publishes the npm packages and uploads the tarballs.
99100
functions:
100101
checkout:
@@ -514,6 +515,88 @@ functions:
514515
./usr/bin/mongosh --smokeTests
515516
}
516517

518+
generate_license_and_vulnerability_report:
519+
- command: expansions.write
520+
params:
521+
file: tmp/expansions.yaml
522+
redacted: true
523+
- command: shell.exec
524+
params:
525+
working_dir: src
526+
shell: bash
527+
env:
528+
NODE_JS_VERSION: ${node_js_version}
529+
EVERGREEN_IS_PATCH: ${is_patch}
530+
SNYK_TOKEN: ${snyk_token}
531+
script: |
532+
set -e
533+
export NODE_JS_VERSION=${node_js_version}
534+
source .evergreen/setup-env.sh
535+
536+
# validate licenses, we first remove THIRD_PARTY_NOTICES.md, so we are sure
537+
# that we would only upload the newly generated file in case of success.
538+
rm THIRD_PARTY_NOTICES.md
539+
npm run update-third-party-notices
540+
541+
# generate vulnerability report: can only fail if is not a patch.
542+
npm run generate-vulnerability-report || { [ "$EVERGREEN_IS_PATCH" == "true" ] && exit 0; } || exit 1
543+
544+
- command: s3.put
545+
params:
546+
aws_key: ${aws_key}
547+
aws_secret: ${aws_secret}
548+
bucket: mciuploads
549+
permissions: private
550+
visibility: signed
551+
local_file: src/.sbom/dependencies.json
552+
remote_file: ${project}/${revision}_${revision_order_id}/dependencies.json
553+
content_type: application/json
554+
optional: true
555+
- command: s3.put
556+
params:
557+
aws_key: ${aws_key}
558+
aws_secret: ${aws_secret}
559+
bucket: mciuploads
560+
permissions: private
561+
visibility: signed
562+
local_file: src/.sbom/snyk-test-result.json
563+
remote_file: ${project}/${revision}_${revision_order_id}/snyk-test-result.json
564+
content_type: application/json
565+
optional: true
566+
- command: s3.put
567+
params:
568+
aws_key: ${aws_key}
569+
aws_secret: ${aws_secret}
570+
bucket: mciuploads
571+
permissions: private
572+
visibility: signed
573+
local_file: src/.sbom/snyk-test-result.html
574+
remote_file: ${project}/${revision}_${revision_order_id}/snyk-test-result.html
575+
content_type: text/html
576+
optional: true
577+
- command: s3.put
578+
params:
579+
aws_key: ${aws_key}
580+
aws_secret: ${aws_secret}
581+
bucket: mciuploads
582+
permissions: private
583+
visibility: signed
584+
local_file: src/.sbom/vulnerability-report.md
585+
remote_file: ${project}/${revision}_${revision_order_id}/vulnerability-report.md
586+
content_type: text/markdown
587+
optional: true
588+
- command: s3.put
589+
params:
590+
aws_key: ${aws_key}
591+
aws_secret: ${aws_secret}
592+
bucket: mciuploads
593+
permissions: private
594+
visibility: signed
595+
local_file: src/THIRD_PARTY_NOTICES.md
596+
remote_file: ${project}/${revision}_${revision_order_id}/THIRD_PARTY_NOTICES.md
597+
content_type: text/markdown
598+
optional: true
599+
517600
release_draft:
518601
- command: expansions.write
519602
params:
@@ -585,6 +668,7 @@ functions:
585668
# package_and_upload_artifact - Upload the release binary to S3.
586669
# test_linux_artifact - Test that the built artifact works where we expect it to.
587670
# release_publish - Publishes the npm packages and uploads the tarballs.
671+
# generate_license_and_vulnerability_report - Generates a report of vulnerabilities affecting the bundled application.
588672
# pkg_test_* - Run tests on the release packages
589673
tasks:
590674
- name: compile_ts
@@ -706,6 +790,20 @@ tasks:
706790
vars:
707791
node_js_version: "<% out(NODE_JS_VERSION_16) %>"
708792

793+
- name: generate_license_and_vulnerability_report
794+
depends_on:
795+
- name: compile_ts
796+
variant: linux_unit
797+
commands:
798+
- func: checkout
799+
- func: install
800+
vars:
801+
node_js_version: "<% out(NODE_JS_VERSION_16) %>"
802+
npm_deps_mode: cli_build
803+
- func: generate_license_and_vulnerability_report
804+
vars:
805+
node_js_version: "<% out(NODE_JS_VERSION_16) %>"
806+
709807
###
710808
# E2E TESTS
711809
###
@@ -1176,3 +1274,9 @@ buildvariants:
11761274
- name: release_draft
11771275
- name: release_publish_dry_run
11781276
- name: release_publish
1277+
1278+
- name: generate_license_and_vulnerability_report
1279+
display_name: "License and Vulnerability Report"
1280+
run_on: ubuntu2004-small
1281+
tasks:
1282+
- name: generate_license_and_vulnerability_report

‎.github/workflows/cron-tasks.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,11 @@ jobs:
1313
steps:
1414
- uses: actions/checkout@v1
1515
- uses: actions/setup-node@v2
16-
- name: Install Dependencies
16+
- name: Install Dependencies and Compile
1717
run: |
1818
npm ci
1919
npm run bootstrap-ci
20+
npm run compile-ts
2021
- name: Set up Git
2122
run: |
2223
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,4 @@ tmp/
2323
dist.tgz
2424
compiled-ts.tgz
2525
mongocryptd.pid
26+
.sbom

‎.snyk‎

Whitespace-only changes.

0 commit comments

Comments
 (0)