

fortifyExecuteScan

This BETA step executes a Fortify scan on the specified project to perform static code analysis and check the source code for security flaws.

Description

This step executes a Fortify scan on the specified project to perform static code analysis and check the source code for security flaws.

The Fortify step triggers a scan locally on your Jenkins within a docker container so finally you have to supply a docker image with a Fortify SCA and Java plus Maven or alternatively Python installed into it for being able to perform any scans.

DISCLAIMER: The step has not yet been tested on a wide variaty of projects, and is therefore considered of BETA quality.

Usage

We recommend to define values of step parameters via config.yml file. In this case, calling the step is reduced to one simple line.
Calling the step can be done either via the Jenkins library step or on the command line.

Jenkins pipelines

fortifyExecuteScan script: this

Command line

piper fortifyExecuteScan

Outputs

Output type	Details
influx	measurement fortify_data projectName projectVersion violations corporateTotal corporateAudited auditAllTotal auditAllAudited spotChecksTotal spotChecksAudited spotChecksGap suspicious exploitable suppressed

Parameters

Overview

Name	Mandatory	Additional information
authToken	yes	pass via ENV or Jenkins credentials
fortifyCredentialsId	yes	id of credentials (using credentials)
githubTokenCredentialsId	yes	id of credentials (using credentials)
script	yes	reference to Jenkins main pipeline script
serverUrl	yes
apiEndpoint	no
artifactUrl	no
autoCreate	no
autodetectClasspath	no
buildDescriptorFile	no
buildTool	no
commitId	no
commitMessage	no
considerSuspicious	no
containerCommand	no
containerShell	no
deltaMinutes	no
dockerEnvVars	no
dockerImage	no
dockerName	no
dockerOptions	no
dockerPullImage	no
dockerVolumeBind	no
dockerWorkspace	no
exclude	no
filterSetTitle	no
fprDownloadEndpoint	no
fprUploadEndpoint	no
githubApiUrl	no
githubToken	no	pass via ENV or Jenkins credentials
globalSettingsFile	no
m2Path	no
memory	no
modulePath	no
mustAuditIssueGroups	no
owner	no
pollingMinutes	no
projectName	no
projectSettingsFile	no
pullRequestMessageRegex	no
pullRequestMessageRegexGroup	no
pullRequestName	no
pythonAdditionalPath	no
pythonInstallCommand	no
pythonRequirementsFile	no
pythonRequirementsInstallSuffix	no
pythonVersion	no
quickScan	no
reportDownloadEndpoint	no
reportTemplateId	no
reportType	no
reporting	no
repository	no
spotAuditIssueGroups	no
spotCheckMinimum	no
src	no
stashContent	no
translate	no
updateRulePack	no
uploadResults	no
verbose	no	activates debug output
versioningModel	no

Details

apiEndpoint

Fortify SSC endpoint used for uploading the scan results and checking the audit state

back to overview

Scope	Details
Aliases	fortifyApiEndpoint
Type	string
Mandatory	no
Default	/api/v1
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

artifactUrl

Path/URL pointing to an additional artifact repository for resolution of additional artifacts during the build

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_artifactUrl (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

authToken

The FortifyToken to use for authentication

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default	$PIPER_authToken (if set)
Secret	yes
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

autoCreate

Whether Fortify project and project version shall be implicitly auto created in case they cannot be found in the backend

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	false
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

autodetectClasspath

Whether the classpath is automatically determined via build tool i.e. maven or pip or not at all

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	true
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

buildDescriptorFile

Path to the build descriptor file addressing the module/folder to be scanned. Defaults are for buildTool=maven: ./pom.xml, buildTool=pip: ./setup.py.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_buildDescriptorFile (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

buildTool

Scan type used for the step which can be 'maven', 'pip'

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	maven
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

commitId

Set the Git commit ID for identifying artifacts throughout the scan.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_commitId (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	commonPipelineEnvironment:   reference to: git/commitId

commitMessage

Set the Git commit message for identifying pull request merges throughout the scan.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_commitMessage (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	commonPipelineEnvironment:   reference to: git/commitMessage

considerSuspicious

Whether suspicious issues should trigger the check to fail or not

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	true
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

containerCommand

Jenkins-specific: Used for proper environment setup.

Kubernetes only: Allows to specify start command for container created with dockerImage parameter to overwrite Piper default (/usr/bin/tail -f /dev/null).

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

containerShell

Jenkins-specific: Used for proper environment setup.

Allows to specify the shell to be executed for container with containerName.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

deltaMinutes

The number of minutes for which an uploaded FPR artifact is considered to be recent and healthy, if exceeded an error will be thrown

back to overview

Scope	Details
Aliases	-
Type	int
Mandatory	no
Default	5
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

dockerEnvVars

Jenkins-specific: Used for proper environment setup.

Environment variables to set in the container, e.g. [http_proxy: "proxy:8080"].

back to overview

Scope	Details
Aliases	-
Type	map[string]string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

dockerImage

Jenkins-specific: Used for proper environment setup.

Name of the docker image that should be used. If empty, Docker is not used and the command is executed directly on the Jenkins system.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

dockerName

Jenkins-specific: Used for proper environment setup.

Kubernetes only: Name of the container launching dockerImage. SideCar only: Name of the container in local network.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

dockerOptions

Jenkins-specific: Used for proper environment setup.

Docker options to be set when starting the container.

back to overview

Scope	Details
Aliases	-
Type	[]string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

dockerPullImage

Jenkins-specific: Used for proper environment setup.

Set this to 'false' to bypass a docker image pull. Usefull during development process. Allows testing of images which are available in the local registry only.

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	false
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

dockerVolumeBind

Jenkins-specific: Used for proper environment setup.

Volumes that should be mounted into the docker container.

back to overview

Scope	Details
Aliases	-
Type	map[string]string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

dockerWorkspace

Jenkins-specific: Used for proper environment setup.

Kubernetes only: Specifies a dedicated user home directory for the container which will be passed as value for environment variable HOME.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

exclude

A list of directories/files to be excluded from the scan. Wildcards can be used, e.g., '**/Test.java'. If translate is set, this will ignored.

back to overview

Scope	Details
Aliases	-
Type	[]string
Mandatory	no
Default	$PIPER_exclude (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

filterSetTitle

Title of the filter set to use for analysing the results

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	SAP
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

fortifyCredentialsId

Jenkins-specific: Used for proper environment setup.

Jenkins 'Secret text' credentials ID containing token to authenticate to Fortify SSC.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

fprDownloadEndpoint

Fortify SSC endpoint for FPR downloads

back to overview

Scope	Details
Aliases	fortifyFprDownloadEndpoint
Type	string
Mandatory	no
Default	/download/currentStateFprDownload.html
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

fprUploadEndpoint

Fortify SSC endpoint for FPR uploads

back to overview

Scope	Details
Aliases	fortifyFprUploadEndpoint
Type	string
Mandatory	no
Default	/upload/resultFileUpload.html
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

githubApiUrl

Set the GitHub API URL.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	https://api.github.com
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

githubToken

GitHub personal access token as per https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_githubToken (if set)
Secret	yes
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

githubTokenCredentialsId

Jenkins-specific: Used for proper environment setup.

Jenkins 'Secret text' credentials ID containing token to authenticate to GitHub.

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	yes
Default
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

globalSettingsFile

Path to the mvn settings file that should be used as global settings file.

back to overview

Scope	Details
Aliases	maven/globalSettingsFile
Type	string
Mandatory	no
Default	$PIPER_globalSettingsFile (if set)
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

m2Path

Path to the location of the local repository that should be used.

back to overview

Scope	Details
Aliases	maven/m2Path
Type	string
Mandatory	no
Default	$PIPER_m2Path (if set)
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

memory

The amount of memory granted to the translate/scan executions

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	-Xmx4G -Xms512M
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

modulePath

Allows providing the path for the module to scan

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	./
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

mustAuditIssueGroups

Comma separated list of issue groups that must be audited completely

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	Corporate Security Requirements, Audit All
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

owner

Set the GitHub organization.

back to overview

Scope	Details
Aliases	githubOrg
Type	string
Mandatory	no
Default	$PIPER_owner (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	commonPipelineEnvironment:   reference to: github/owner

pollingMinutes

The number of minutes for which an uploaded FPR artifact''s status is being polled to finish queuing/processing, if exceeded polling will be stopped and an error will be thrown

back to overview

Scope	Details
Aliases	-
Type	int
Mandatory	no
Default	30
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

projectName

The project used for reporting results in SSC

back to overview

Scope	Details
Aliases	fortifyProjectName
Type	string
Mandatory	no
Default	{{list .GroupID .ArtifactID | join "-" | trimAll "-"}}
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

projectSettingsFile

Path to the mvn settings file that should be used as project settings file.

back to overview

Scope	Details
Aliases	maven/projectSettingsFile
Type	string
Mandatory	no
Default	$PIPER_projectSettingsFile (if set)
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

pullRequestMessageRegex

Regex used to identify the PR-XXX reference within the merge commit message

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	.*Merge pull request #(\\d+) from.*
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

pullRequestMessageRegexGroup

The group number for extracting the pull request id in 'pullRequestMessageRegex'

back to overview

Scope	Details
Aliases	-
Type	int
Mandatory	no
Default	1
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

pullRequestName

The name of the pull request branch which will trigger creation of a new version in Fortify SSC based on the master branch version

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_pullRequestName (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

pythonAdditionalPath

A list of additional paths which can be used in buildTool: 'pip' for customization purposes

back to overview

Scope	Details
Aliases	-
Type	[]string
Mandatory	no
Default	- ./lib - .
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

pythonInstallCommand

Additional install command that can be run when buildTool: 'pip' is used which allows further customizing the execution environment of the scan

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	{{.Pip}} install --user .
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

pythonRequirementsFile

The requirements file used in buildTool: 'pip' to populate the build environment with the necessary dependencies

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_pythonRequirementsFile (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

pythonRequirementsInstallSuffix

The suffix for the command used to install the requirements file in buildTool: 'pip' to populate the build environment with the necessary dependencies

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_pythonRequirementsInstallSuffix (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

pythonVersion

Python version to be used in buildTool: 'pip'

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	python3
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

quickScan

Whether a quick scan should be performed, please consult the related Fortify documentation on JAM on the impact of this setting

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	false
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

reportDownloadEndpoint

Fortify SSC endpoint for Report downloads

back to overview

Scope	Details
Aliases	fortifyReportDownloadEndpoint
Type	string
Mandatory	no
Default	/transfer/reportDownload.html
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

reportTemplateId

Report template ID to be used for generating the Fortify report

back to overview

Scope	Details
Aliases	-
Type	int
Mandatory	no
Default	18
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

reportType

The type of report to be generated

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	PDF
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

reporting

Influences whether a report is generated or not

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	false
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

repository

Set the GitHub repository.

back to overview

Scope	Details
Aliases	githubRepo
Type	string
Mandatory	no
Default	$PIPER_repository (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	commonPipelineEnvironment:   reference to: github/repository

script

Jenkins-specific: Used for proper environment setup.

The common script environment of the Jenkinsfile running. Typically the reference to the script calling the pipeline step is provided with the this parameter, as in script: this. This allows the function to access the commonPipelineEnvironment for retrieving, e.g. configuration parameters.

back to overview

Scope	Details
Aliases	-
Type	Jenkins Script
Mandatory	yes
Default
Secret	no
Configuration scope	☐ parameter ☐ general ☐ steps ☐ stages
Resource references	none

serverUrl

Fortify SSC Url to be used for accessing the APIs

back to overview

Scope	Details
Aliases	- fortifyServerUrl - sscUrl (deprecated)
Type	string
Mandatory	yes
Default	$PIPER_serverUrl (if set)
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

spotAuditIssueGroups

Comma separated list of issue groups that are spot checked and for which spotCheckMinimum audited issues are enforced

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	Spot Checks of Each Category
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

spotCheckMinimum

The minimum number of issues that must be audited per category in the Spot Checks of each Category folder to avoid an error being thrown

back to overview

Scope	Details
Aliases	-
Type	int
Mandatory	no
Default	1
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

src

A list of source directories to scan. Wildcards can be used, e.g., 'src/main/java/**/*'. If 'translate' is set, this will ignored. The default value for buildTool: 'maven' is ['/*.xml', '/.html', '/*.jsp', '/.js', '/src/main/resources//', '/src/main/java//'], for buildTool: 'pip' it is ['./*/'].

back to overview

Scope	Details
Aliases	-
Type	[]string
Mandatory	no
Default	$PIPER_src (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

stashContent

Jenkins-specific: Used for proper environment setup.

Specific stashes that should be considered for the step execution.

back to overview

Scope	Details
Aliases	-
Type	[]string
Mandatory	no
Default	- buildDescriptor - deployDescriptor - tests - opensourceConfiguration
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

translate

Options for translate phase of Fortify. Most likely, you do not need to set this parameter. See src, exclude. If 'src' and 'exclude' are set they are automatically used. Technical details: It has to be a JSON string of list of maps with required key 'src', and optional keys 'exclude', 'libDirs', 'aspnetcore', and 'dotNetCoreVersion'

back to overview

Scope	Details
Aliases	-
Type	string
Mandatory	no
Default	$PIPER_translate (if set)
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

updateRulePack

Whether the rule pack shall be updated and pulled from Fortify SSC before scanning or not

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	true
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

uploadResults

Whether results shall be uploaded or not

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	true
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☐ general ☒ steps ☒ stages
Resource references	none

verbose

verbose output

back to overview

Scope	Details
Aliases	-
Type	bool
Mandatory	no
Default	false
Possible values	- true - false
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none

versioningModel

The default project versioning model used for creating the version based on the build descriptor version to report results in SSC, can be one of 'major', 'major-minor', 'semantic', 'full'

back to overview

Scope	Details
Aliases	defaultVersioningModel (deprecated)
Type	string
Mandatory	no
Default	major
Possible values	- major - major-minor - semantic - full
Secret	no
Configuration scope	☒ parameter ☒ general ☒ steps ☒ stages
Resource references	none