stable
Clone or download
Closes request #31123: Automate scanning for known vulnerabilities in dependencies
This contribution introduces a new Jenkins pipeline that will executed once a day. Developers can execute the same thing locally with `make scan-vuln-deps`. It uses the recently introduced OSV-Scanner [0][1]. The PHP, JS, Go and Rust dependencies are covered. Nix derivations could be covered in the future by creating SBOM for them (but note that for "new" tools/services we are using the package manager associated with the language anyway). The goals are to: * gives the whole dev team the possibility to participate to the triage or at least be aware of it * have a better view of the state of our dependency tree * force a response when a vulnerability is discovered in our dependency tree even if it is "ignore it for now" * see how noisy it is day-to-day This approach has shortcomings (ignore vulns is not scoped by sub-packages, does not give a centralized view across the supported Tuleap versions...) but it requires little to no additional infrastructure and it is still better than what we currently have. Deploying tools like Dependency-Track [2] could be considered later on but the work done here will not be wasted anyway (even more since they started using the OSV.dev database). [0] https://security.googleblog.com/2022/12/announcing-osv-scanner-vulnerability.html [1] https://github.com/google/osv-scanner [2] https://dependencytrack.org/ Change-Id: I4fee861bbd591e385cfe3f9dfe7006c4adeff7da
Modified Files
| Name | ||||
|---|---|---|---|---|
| M | Makefile | +4 | −0 | Go to diff View file |
| D | plugins/mytuleap_contact_support/Jenkinsfile | +0 | −114 | Go to diff View file |
| M | tests/Jenkinsfile | +4 | −4 | Go to diff View file |
| M | tests/Jenkinsfile-nightly | +2 | −2 | Go to diff View file |
| A | tests/Jenkinsfile-security-scan-vuln-deps | +53 | −0 | Go to diff View file |
| M | tests/Jenkinsfile-security-taint-analysis | +1 | −1 | Go to diff View file |
| M | tests/build_and_run/test.sh | +1 | −1 | Go to diff View file |
| M | tools/publish_js_libraries/Jenkinsfile | +5 | −5 | Go to diff View file |
| M | tools/rpm/build_and_run_packages.sh | +1 | −1 | Go to diff View file |
| M | tools/utils/nix/dev-tools/default.nix | +1 | −0 | Go to diff View file |
| R | tools/utils/nix/build-tools.dockerfile | Go to diff View file | ||
| A | tools/utils/osv-scanner/config.toml | +359 | −0 | Go to diff View file |