Skip to content

Commit 339bd2c

Browse files
stIncMalestIncMale
authored
Create and upload ssdlc_compliance_report.md (#1405)
JAVA-5435
1 parent 46fda2f commit 339bd2c

File tree

3 files changed

+179
-20
lines changed

3 files changed

+179
-20
lines changed

‎.evergreen/.evg.yml

Lines changed: 52 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,45 @@ functions:
142142
content_type: ${content_type|text/plain}
143143
display_name: "orchestration.log"
144144

145+
"create and upload SSDLC release assets":
146+
- command: shell.exec
147+
shell: "bash"
148+
params:
149+
working_dir: "src"
150+
env:
151+
PRODUCT_NAME: ${product_name}
152+
PRODUCT_VERSION: ${product_version}
153+
script: .evergreen/ssdlc-report.sh
154+
- command: ec2.assume_role
155+
params:
156+
role_arn: ${UPLOAD_SSDLC_RELEASE_ASSETS_ROLE_ARN}
157+
- command: s3.put
158+
params:
159+
aws_key: ${AWS_ACCESS_KEY_ID}
160+
aws_secret: ${AWS_SECRET_ACCESS_KEY}
161+
aws_session_token: ${AWS_SESSION_TOKEN}
162+
local_file: ./src/build/ssdlc/ssdlc_compliance_report.md
163+
remote_file: ${product_name}/${product_version}/ssdlc_compliance_report.md
164+
bucket: java-driver-release-assets
165+
region: us-west-1
166+
permissions: private
167+
content_type: text/markdown
168+
display_name: ssdlc_compliance_report.md
169+
- command: s3.put
170+
params:
171+
aws_key: ${AWS_ACCESS_KEY_ID}
172+
aws_secret: ${AWS_SECRET_ACCESS_KEY}
173+
aws_session_token: ${AWS_SESSION_TOKEN}
174+
local_files_include_filter:
175+
- build/ssdlc/static-analysis-reports/*.sarif
176+
local_files_include_filter_prefix: ./src/
177+
remote_file: ${product_name}/${product_version}/static-analysis-reports/
178+
bucket: java-driver-release-assets
179+
region: us-west-1
180+
permissions: private
181+
content_type: application/sarif+json
182+
display_name:
183+
145184
"upload test results":
146185
- command: attach.xunit_results
147186
params:
@@ -692,24 +731,21 @@ functions:
692731
params:
693732
working_dir: "src"
694733
script: |
695-
tag=$(git describe --tags --always --dirty)
696-
697-
# remove the leading 'r'
698-
version=$(echo -n "$tag" | cut -c 2-)
699-
700-
cat <<EOT > trace-expansions.yml
701-
release_version: "$version"
702-
EOT
703-
cat trace-expansions.yml
734+
PRODUCT_VERSION="$(echo -n "$(git describe --tags --always --dirty)" | cut -c 2-)"
735+
cat > ssdlc-expansions.yml <<EOF
736+
product_version: "$PRODUCT_VERSION"
737+
product_name: "${product_name}"
738+
EOF
739+
cat ssdlc-expansions.yml
704740
- command: expansions.update
705741
params:
706-
file: src/trace-expansions.yml
742+
file: src/ssdlc-expansions.yml
707743
- command: papertrail.trace
708744
params:
709745
key_id: ${papertrail_key_id}
710746
secret_key: ${papertrail_secret_key}
711-
product: ${product}
712-
version: ${release_version}
747+
product: ${product_name}
748+
version: ${product_version}
713749
filenames:
714750
- "src/build/repo/org/mongodb/*/*/*.jar"
715751
- "src/build/repo/org/mongodb/*/*/*.pom"
@@ -1440,15 +1476,17 @@ tasks:
14401476
- func: "publish snapshot"
14411477
- func: "trace artifacts"
14421478
vars:
1443-
product: mongo-java-driver-snapshot
1479+
product_name: mongo-java-driver-snapshot
1480+
- func: "create and upload SSDLC release assets"
14441481

14451482
- name: publish-release
14461483
git_tag_only: true
14471484
commands:
14481485
- func: "publish release"
14491486
- func: "trace artifacts"
14501487
vars:
1451-
product: mongo-java-driver
1488+
product_name: mongo-java-driver
1489+
- func: "create and upload SSDLC release assets"
14521490

14531491
- name: "perf"
14541492
tags: ["perf"]

‎.evergreen/ssdlc-report.sh

Lines changed: 57 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,66 @@
1-
#!/bin/bash
1+
#!/usr/bin/env bash
22

3-
set -o errexit
3+
set -eu
4+
5+
# Supported/used environment variables:
6+
# PRODUCT_NAME
7+
# PRODUCT_VERSION
8+
9+
if [ -z "${PRODUCT_NAME}" ]; then
10+
echo "PRODUCT_NAME must be set to a non-empty string"
11+
exit 1
12+
fi
13+
if [ -z "${PRODUCT_VERSION}" ]; then
14+
echo "PRODUCT_VERSION must be set to a non-empty string"
15+
exit 1
16+
fi
417

518
############################################
619
# Main Program #
720
############################################
821
RELATIVE_DIR_PATH="$(dirname "${BASH_SOURCE[0]:-$0}")"
922
source "${RELATIVE_DIR_PATH}/javaConfig.bash"
1023

11-
echo "Creating SSLDC reports"
24+
printf "\nCreating SSDLC reports\n"
25+
26+
declare -r SSDLC_PATH="${RELATIVE_DIR_PATH}/../build/ssdlc"
27+
declare -r SSDLC_STATIC_ANALYSIS_REPORTS_PATH="${SSDLC_PATH}/static-analysis-reports"
28+
mkdir "${SSDLC_PATH}"
29+
mkdir "${SSDLC_STATIC_ANALYSIS_REPORTS_PATH}"
30+
31+
printf "\nCreating SpotBugs SARIF reports\n"
1232
./gradlew -version
13-
./gradlew -PssdlcReport.enabled=true --continue -x test -x integrationTest -x spotlessApply clean check scalaCheck kotlinCheck testClasses || true
14-
echo "SpotBugs created the following SARIF files"
15-
find . -path "*/spotbugs/*.sarif"
33+
set +e
34+
# This `gradlew` command is expected to exit with a non-zero exit status,
35+
# because it reports all the findings that we normally explicitly exclude as "No Fix Needed"/"False Positive".
36+
./gradlew -PssdlcReport.enabled=true --continue -x test -x integrationTest -x spotlessApply check scalaCheck kotlinCheck
37+
set -e
38+
printf "\nSpotBugs created the following SARIF reports\n"
39+
IFS=$'\n'
40+
declare -a SARIF_PATHS=($(find "${RELATIVE_DIR_PATH}/.." -path "*/spotbugs/*.sarif"))
41+
unset IFS
42+
for SARIF_PATH in "${SARIF_PATHS[@]}"; do
43+
GRADLE_PROJECT_NAME="$(basename "$(dirname "$(dirname "$(dirname "$(dirname "${SARIF_PATH}")")")")")"
44+
NEW_SARIF_PATH="${SSDLC_STATIC_ANALYSIS_REPORTS_PATH}/${GRADLE_PROJECT_NAME}_$(basename "${SARIF_PATH}")"
45+
cp "${SARIF_PATH}" "${NEW_SARIF_PATH}"
46+
printf "%s\n" "${NEW_SARIF_PATH}"
47+
done
48+
49+
printf "\nCreating SSDLC compliance report\n"
50+
declare -r TEMPLATE_SSDLC_REPORT_PATH="${RELATIVE_DIR_PATH}/template_ssdlc_compliance_report.md"
51+
declare -r SSDLC_REPORT_PATH="${SSDLC_PATH}/ssdlc_compliance_report.md"
52+
cp "${TEMPLATE_SSDLC_REPORT_PATH}" "${SSDLC_REPORT_PATH}"
53+
declare -a SED_EDIT_IN_PLACE_OPTION
54+
if [[ "$OSTYPE" == "darwin"* ]]; then
55+
SED_EDIT_IN_PLACE_OPTION=(-i '')
56+
else
57+
SED_EDIT_IN_PLACE_OPTION=(-i)
58+
fi
59+
sed "${SED_EDIT_IN_PLACE_OPTION[@]}" \
60+
-e "s/\${product_name}/${PRODUCT_NAME}/g" \
61+
-e "s/\${product_version}/${PRODUCT_VERSION}/g" \
62+
-e "s/\${report_date_utc}/$(date -u +%Y-%m-%d)/g" \
63+
"${SSDLC_REPORT_PATH}"
64+
printf "%s\n" "${SSDLC_REPORT_PATH}"
65+
66+
printf "\n"

‎.evergreen/template_ssdlc_compliance_report.md

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# ${product_name} SSDLC compliance report
2+
3+
This report is available at
4+
<https://d-9067613a84.awsapps.com/start/#/console?account_id=857654397073&role_name=Drivers.User&destination=https%3a%2f%2fus-west-1.console.aws.amazon.com%2fs3%2fobject%2fjava-driver-release-assets%3fregion%3dus-west-1%26bucketType%3dgeneral%26prefix%3d${product_name}%2f${product_version}%2fssdlc_compliance_report.md>.
5+
6+
<table>
7+
<tr>
8+
<th>Product name</th>
9+
<td><a href="https://github.com/mongodb/mongo-java-driver">${product_name}</a></td>
10+
</tr>
11+
<tr>
12+
<th>Product version</th>
13+
<td>${product_version}</td>
14+
</tr>
15+
<tr>
16+
<th>Report date, UTC</th>
17+
<td>${report_date_utc}</td>
18+
</tr>
19+
</table>
20+
21+
## Release creator
22+
23+
This information is available in multiple ways:
24+
25+
<table>
26+
<tr>
27+
<th>Evergreen</th>
28+
<td>
29+
Go to
30+
<a href="https://evergreen.mongodb.com/waterfall/mongo-java-driver?bv_filter=Publish%20Release">
31+
https://evergreen.mongodb.com/waterfall/mongo-java-driver?bv_filter=Publish%20Release</a>,
32+
find the build triggered from Git tag <code>r${product_version}</code>, see who authored it.
33+
</td>
34+
</tr>
35+
<tr>
36+
<th>Papertrail</th>
37+
<td>
38+
Refer to data in Papertrail. There is currently no official way to serve that data.
39+
</td>
40+
</tr>
41+
</table>
42+
43+
## Process document
44+
45+
Blocked on <https://jira.mongodb.org/browse/JAVA-5429>.
46+
47+
The MongoDB SSDLC policy is available at
48+
<https://docs.google.com/document/d/1u0m4Kj2Ny30zU74KoEFCN4L6D_FbEYCaJ3CQdCYXTMc>.
49+
50+
## Third-darty dependency information
51+
52+
There are no dependencies to report vulnerabilities of.
53+
Our [SBOM](https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/docs/CYCLONEDX/) lite
54+
is <https://github.com/mongodb/mongo-java-driver/blob/r${product_version}/sbom.json>.
55+
56+
## Static analysis findings
57+
58+
The static analysis findings are all available at
59+
<https://d-9067613a84.awsapps.com/start/#/console?account_id=857654397073&role_name=Drivers.User&destination=https%3a%2f%2fus-west-1.console.aws.amazon.com%2fs3%2fbuckets%2fjava-driver-release-assets%3fregion%3dus-west-1%26bucketType%3dgeneral%26prefix%3d${product_name}%2f${product_version}%2fstatic-analysis-reports%2f>.
60+
All the findings in the aforementioned reports
61+
are either of the MongoDB status "False Positive" or "No Fix Needed",
62+
because code that has any other findings cannot technically get into the product.
63+
64+
<https://github.com/mongodb/mongo-java-driver/blob/r${product_version}/config/spotbugs/exclude.xml> may also be of interest.
65+
66+
## Signature information
67+
68+
The product artifacts are signed.
69+
The signatures can be verified by following instructions at
70+
<https://github.com/mongodb/mongo-java-driver/releases/tag/r${product_version}>.

0 commit comments

Comments
 (0)