Skip to content

Commit 593bb69

Browse files
1tacocat11tacocat1
authored
Merge pull request #3 from nowsecure/update-upstream
chore: sync upstream
2 parents 49d6bca + 8838c74 commit 593bb69

39 files changed

Lines changed: 1247 additions & 1068 deletions

‎Development.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# NowSecure AUTO Jenkins Plugin
2+
3+
## Building
4+
```
5+
mvn hpi:run
6+
```
7+
8+
## Findbugs
9+
```
10+
mvn findbugs:gui
11+
```
12+
13+
## Local Installing
14+
```
15+
mvn clean install
16+
cp target/nowsecure-auto-security-test.hpi ~/.jenkins/plugins/
17+
```
18+
Then redeploy Jenkins.
19+
20+
## Jenkins Host Deployment
21+
```
22+
mvn release:prepare release:perform -Dusername=... -Dpassword=...
23+
```
24+
25+
## Testing Master/Slave
26+
- Create Slave node in Jenkins
27+
- Download agent.jar from master
28+
```
29+
url http://host:port/jnlpJars/agent.jar
30+
```
31+
- Start slave from another machine
32+
```
33+
java -jar agent.jar -jnlpUrl http://host:port/jenkins/computer/slave1/slave-agent.jnlp -secret xxxx -workDir ""
34+
```
35+
Note: in above example, slave is called slave1. You can go to slave node config in Jenkins to see the secret.
36+
37+
## Jenkins Upload permissions
38+
- https://github.com/jenkins-infra/repository-permissions-updater/permissions/plugin-nowsecure-auto-security-test.yml
39+
40+
## Wiki
41+
- https://wiki.jenkins.io/display/JENKINS/NowSecure+AUTO+Jenkins+Plugin
42+
43+
44+
## Resources
45+
- https://wiki.jenkins.io/display/JENKINS/Hosting+Plugins
46+
- https://wiki.jenkins.io/display/JENKINS/Credentials+Plugin
47+
- https://github.com/jenkins-infra/repository-permissions-updater
48+
- https://wiki.jenkins.io/display/JENKINS/Plugins
49+
- https://repo.jenkins-ci.org/releases/io/jenkins/plugins/nowsecure-auto-security-test/

‎GettingStarted.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# NowSecure AUTO Jenkins Plugin
2+
3+
### Generate API Key
4+
See https://docs.nowsecure.com/auto/integration-services/jenkins-integration for adding API token.
5+
6+
### Store API Key in Jenkins Credentials
7+
Select Credentials from sideline:
8+
![Credentials](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins3.png)
9+
10+
Store API Key as Secret text:
11+
![StoreCredentials](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins4.png)
12+
13+
### Define Jenkins Job
14+
![New Build](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins1.png)
15+
16+
### Bind Credentials with apiKey variable
17+
![Bind](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins5.png)
18+
19+
### Adding Plugin to your mobile build
20+
Select Configure option from Jenkins console, then select dropdown of build step and choose NS Auto Jenkins Plugin, e.g.
21+
![Build Step](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins6.png)
22+
23+
### Specify configuration parameters
24+
![Configure Step](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins7.png)
25+
26+
## Advanced configuration options
27+
![Advanced](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins8.png)
28+
29+
## Kick off build
30+
Kick off your mobile builds and you will see the raw JSON reports and score under artifacts folder.
31+
![Console](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins9.png)
32+
33+
## Pipeline
34+
Adding plugin to pipeline:
35+
![Pipeline Setup](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins10.png)
36+
37+
![Pipeline Config](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins11.png)
38+
39+
Sample pipeline script
40+
```
41+
pipeline {
42+
agent any
43+
stages {
44+
stage('security-test') {
45+
environment {
46+
apiKey = credentials('AutoApiKey')
47+
}
48+
steps {
49+
step([$class: 'NSAutoPlugin', apiKey: env.apiKey, binaryName: 'myapk.apk', breakBuildOnScore: true, description: 'my description', group: 'mygroup', waitForResults: true, showStatusMessages: true, debug: true, proxyEnabled: false])
50+
}
51+
}
52+
}
53+
}
54+
```
55+
*** Note: The apiKey will retreive credentials from Jenkins; binaryName and group are required fields but other parameters such as breakBuildOnScore, waitForResults and showStatusMessages are optional parameters.
56+
57+
*** Note: proxyEnabled would use Jenkins' proxy settings if available ***
58+
59+
## Artifacts
60+
This plugin generates following artifacts:
61+
![Artifacts](https://github.com/jenkinsci/nowsecure-auto-security-test-plugin/blob/master/images/jenkins12.png)
62+
- nowsecure-auto-security-test-uploaded-binary.json - stores metadata in json format after mobile file is uploaded.
63+
- nowsecure-auto-security-test-preflight.json - stores output json when request of preflight is submitted.
64+
- nowsecure-auto-security-test-request.json - stores output json when request of security test is submitted.
65+
- nowsecure-auto-security-test-report.json - stores output json when security analysis is completed.
66+
- nowsecure-auto-security-test-score.json - stores output json for overall score of security test.
67+
68+
## Resources
69+
- https://plugins.jenkins.io/nowsecure-auto-security-test
70+
- https://wiki.jenkins.io/display/JENKINS/Hosting+Plugins
71+
- https://wiki.jenkins.io/display/JENKINS/Credentials+Plugin
72+

‎Jenkinsfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
buildPlugin()

‎README.md‎

Lines changed: 4 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -18,60 +18,9 @@ This plugin provides the ability to send Android or iOS applications to NowSecur
1818
Documentation for
1919

2020

21-
## Building
22-
```
23-
mvn hpi:run
24-
```
25-
26-
## Findbugs
27-
```
28-
mvn findbugs:gui
29-
```
30-
31-
## Installing
32-
```
33-
mvn clean install
34-
cp target/nowsecure-auto-security-test.hpi ~/.jenkins/plugins/
35-
```
36-
Then redeploy Jenkins.
37-
38-
## Deploying
39-
40-
### Generate API Key
41-
See https://docs.nowsecure.com/auto/integration-services/jenkins-integration for adding API token.
42-
43-
### Store API Key in Jenkins Credentials
44-
Select Credentials from sideline:
45-
![Credentials](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins3.png)
46-
47-
Store API Key as Secret text:
48-
![StoreCredentials](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins4.png)
49-
50-
### Define Jenkins Job
51-
![New Build](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins1.png)
52-
53-
### Bind Credentials with apiKey variable
54-
![Bind](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins5.png)
55-
56-
### Adding Plugin to your mobile build
57-
Select Configure option from Jenkins console, then select dropdown of build step and choose NS Auto Jenkins Plugin, e.g.
58-
![Build Step](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins6.png)
59-
60-
### Specify configuration parameters
61-
![Configure Step](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins7.png)
62-
63-
## Advanced configuration options
64-
![Advanced](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins8.png)
65-
66-
## Kick off build
67-
Kick off your mobile builds and you will see the raw JSON reports and score under artifacts folder.
68-
![Console](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins9.png)
69-
70-
## Pipeline
71-
Adding plugin to pipeline:
72-
![Pipeline](https://github.com/nowsecure/auto-jenkins-plugin/blob/master/images/jenkins10.png)
73-
74-
## Resources
75-
- https://wiki.jenkins.io/display/JENKINS/Credentials+Plugin
21+
This plugin adds the ability to perform automatic mobile app security testing for Android and iOS mobile apps through the NowSecure AUTO test engine.
7622

23+
## Summary:
24+
Purpose-built for mobile app teams, NowSecure AUTO provides fully automated, mobile appsec testing coverage (static+dynamic+behavioral tests) optimized for the dev pipeline. Because NowSecure tests the mobile app binary post-build from Jenkins, it can test software developed in any language and provides complete results including newly developed code, 3rd party code, and compiler/operating system dependencies. With near zero false positives, NowSecure pinpoints real issues in minutes, with developer fix details, and routes tickets automatically into ticketing systems, such as Jira. NowSecure is frequently used to perform security testing in parallel with functional testing in the dev cycle. Requires a license for and connection to the NowSecure AUTO software.
25+
https://www.nowsecure.com
7726

‎images/jenkins11.png‎

-107 KB
Loading

‎images/jenkins12.png‎

56 KB
Loading

‎images/jenkins7.png‎

17.2 KB
Loading

‎images/jenkins8.png‎

21.7 KB
Loading

‎images/jenkins9.png‎

-394 KB
Loading

‎pom.xml‎

Lines changed: 71 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
</parent>
1010
<groupId>io.jenkins.plugins</groupId>
1111
<artifactId>nowsecure-auto-security-test</artifactId>
12-
<version>0.1</version>
12+
<version>1.26-SNAPSHOT</version>
1313
<packaging>hpi</packaging>
1414
<properties>
1515
<jenkins.version>2.7.3</jenkins.version>
@@ -23,11 +23,70 @@
2323
<url>https://opensource.org/licenses/MIT</url>
2424
</license>
2525
</licenses>
26+
<build>
27+
<plugins>
28+
<plugin>
29+
<groupId>org.apache.maven.plugins</groupId>
30+
<artifactId>maven-dependency-plugin</artifactId>
31+
<executions>
32+
<execution>
33+
<id>install-jar</id>
34+
<phase>install</phase>
35+
<goals>
36+
<goal>copy</goal>
37+
</goals>
38+
<configuration>
39+
<artifactItems>
40+
<artifactItem>
41+
<groupId>com.nowsecure</groupId>
42+
<artifactId>auto-circleci-plugin</artifactId>
43+
<version>0.4</version>
44+
<type>jar</type>
45+
<overWrite>true</overWrite>
46+
</artifactItem>
47+
</artifactItems>
48+
<outputDirectory>${project.build.directory}/dist/lib</outputDirectory>
49+
<stripVersion>true</stripVersion>
50+
</configuration>
51+
</execution>
52+
</executions>
53+
</plugin>
54+
<plugin>
55+
<groupId>org.apache.maven.plugins</groupId>
56+
<artifactId>maven-jar-plugin</artifactId>
57+
<configuration>
58+
<archive>
59+
<manifestEntries>
60+
<Jenkins-ClassFilter-Whitelisted>true</Jenkins-ClassFilter-Whitelisted>
61+
</manifestEntries>
62+
</archive>
63+
</configuration>
64+
</plugin>
65+
</plugins>
66+
<resources>
67+
<resource>
68+
<directory>src/main/resources</directory>
69+
<filtering>true</filtering>
70+
<includes>
71+
<include>**/jversion.txt</include>
72+
</includes>
73+
</resource>
74+
<resource>
75+
<directory>src/main/resources</directory>
76+
<filtering>false</filtering>
77+
<excludes>
78+
<exclude>**/jversion.txt</exclude>
79+
</excludes>
80+
</resource>
81+
</resources>
82+
</build>
2683
<dependencies>
2784
<dependency>
28-
<groupId>org.yaml</groupId>
29-
<artifactId>snakeyaml</artifactId>
30-
<version>1.21</version>
85+
<groupId>com.nowsecure</groupId>
86+
<artifactId>auto-circleci-plugin</artifactId>
87+
<version>1.1.0</version>
88+
<scope>system</scope>
89+
<systemPath>${project.basedir}/src/main/webapp/WEB-INF/lib/auto-circleci-plugin-1.1.0.jar</systemPath>
3190
</dependency>
3291
<dependency>
3392
<groupId>com.googlecode.json-simple</groupId>
@@ -83,23 +142,21 @@
83142
</dependency>
84143
</dependencies>
85144

86-
<!-- If you want this to appear on the wiki page:
87145
<developers>
88-
<developer>
89-
<id>bhacker</id>
90-
<name>Bob Q. Hacker</name>
91-
<email>[email protected]</email>
92-
</developer>
93-
</developers> -->
146+
<developer>
147+
<id>bhatti</id>
148+
<name>NowSecure, Inc.</name>
149+
<email>[email protected]</email>
150+
</developer>
151+
</developers>
94152

95-
<!-- Assuming you want to host on @jenkinsci:
96-
<url>https://wiki.jenkins.io/display/JENKINS/TODO+Plugin</url>
97153
<scm>
98154
<connection>scm:git:git://github.com/jenkinsci/${project.artifactId}-plugin.git</connection>
99155
<developerConnection>scm:git:[email protected]:jenkinsci/${project.artifactId}-plugin.git</developerConnection>
100156
<url>https://github.com/jenkinsci/${project.artifactId}-plugin</url>
157+
<tag>HEAD</tag>
101158
</scm>
102-
-->
159+
<url>https://wiki.jenkins.io/display/JENKINS/NowSecure+AUTO+Jenkins+Plugin</url>
103160
<repositories>
104161
<repository>
105162
<id>repo.jenkins-ci.org</id>

0 commit comments

Comments
 (0)