WIXLIB

HP Fortify Jenkins PluginInstallation , Configuration, and UseThe HP Fortify Jenkins Plugin (Jenkins plugin) is used in conjunction with HP FortifySoftware Security Center (SSC), a collaborative system for reviewing and auditing securityanalysis results. If you use a Fortify plugin such as maven to scan your source code aftereach build, the Jenkins plugin automatically uploads the Fortify project results (in an FPRfile) to an SSC server and enables you to view the details within Jenkins. It also providesmetrics for each build and an overview of the results, without having to connect to SSC.This document provides instructions on how to prepare SSC to work with the Jenkinsplugin, and how to install, configure, and use the plugin. For information about Jenkins,see the Jenkins web site (http://jenkins-ci.org).Preparing Software Security Center to Work withthe Jenkins PluginTo prepare SSC to work with the Jenkins plugin, you create a new token type, and thenuse the fortifyclient utility to generate a token of that type. The following topics provideinstructions on how to perform these two tasks.Creating a Jenkins Token TypeThe Jenkins plugin communicates with HP Fortify Software Security Center (SSC) inseveral ways. Since SSC web services are access-controlled, you must define a newauthentication token type that authorizes the various web service requests that the pluginuses.To create this token type:1. From your Software Security Center installation directory, navigate to ternal directory, and thenopen the serviceContext.xml file in a text editor.2. Add the following block of text to the file: bean id "jenkinsToken"class enSpec" property name "key" value "JenkinsToken"/ property name "maxDaysToLive" value "365"/ property name "actionPermitted" list value-type "java.lang.String" value AddProjectRequest /value value AddProjectVersionRequest /value value AddProjectAndVersionRequest /value HP Fortify SoftwareHP Fortify Jenkins Plugin1

value GetAuthenticationTokenRequest /value value ProjectListRequest /value value ActiveProjectVersionListRequest /value value ProjectVersionListRequest /value value ProjectTemplateListRequest /value value FPRUploadRequest /value value AuditViewRequest /value value PerformAuditActionRequest /value value IssueListRequest /value value GetProjectVersionIdentifiersRequest /value value ProjectMetaDataDefinitionsListRequest /value value AddProjectMetaDataDefinitionRequest /value value UpdateProjectMetaDataDefinitionRequest /value value ProjectMetaDataValuesListRequest /value value ProjectMetaDataValueRequest /value value GetSingleUseFPRUploadTokenRequest /value value CreateAuditSessionRequest /value value InvalidateAuditSessionRequest /value value GroupingValuesRequest /value /list /property property name "terminalActions" list value-type "java.lang.String" value InvalidateTokenRequest /value /list /property /bean 3. Save and close the serviceContext.xml file.Generating an SSC Authorization TokenAfter you define a Jenkins token type, you must use the fortifyclient command-lineutility to generate a token instance.To generate an SSC authorization token:1. From the ssc install /Deployment/fortifyclient/bin directory, run thefollowing:fortifyclient token -gettoken JenkinsToken -daysToLive 365 -url ssc url /ssc -user user with appropriate credentials where JenkinsToken is the case-sensitive fortifyclient upload token specifier.Notes: The Software Security Center URL passed to fortifyclient must include both theport number and the context path /ssc/. The correct format for the SSC URL is asfollows:http://nnn.nnn.nnn.nnn:8080/ssc/ The ability of fortifyclient to use the token to read or write information to or fromSSC depends on the account privileges of the SSC user account specified bythe -user parameter.HP Fortify SoftwareHP Fortify Jenkins Plugin2

The fortifyclient utility prompts for a password.2. Type the password for account name .The fortifyclient utility returns a token of the general form cb79c492-0a78-44e3b26c-65c14df52e86.3. Copy the returned token into a text file.For detailed information about the fortifyclient command-line utility, see the HPFortify Software Security Center Installation and Configuration Guide.About Jenkins InstallationIf you do not have Jenkins installed, download version 1.4.30 or later fromhttp://mirrors.jenkins-ci.org/war. The Jenkins plugin works with Jenkins 1.4.30 and laterversions.For more information about how to install and start Jenkins, see the following web Installing /Starting and Accessing JenkinsInstalling the Jenkins PluginTo install the Jenkins plugin, you must have Jenkins installed on your system.To install the Jenkins plugin:1. Open a browser window and navigate to http:// jenkins server url :8080/. (Tostart Jenkins locally, run java -Xmx1024m -XX:MaxPermSize 512m -jar jenkins.war file path .)2. From the Jenkins user interface, select Manage Jenkins, and then select ManagePlugins.3. On the Plugin Manager page, click the Advanced tab.4. In the Upload Plugin section, click Browse, and then locate and select thefortifyJenkins.hpi file.5. Click Upload.6. Restart Jenkins. (If you started Jenkins locally, press CTRL C in the command linewindow to restart it.)HP Fortify SoftwareHP Fortify Jenkins Plugin3

Verifying Plugin InstallationTo verify that the Jenkins plugin is installed:1. Open a browser window and navigate to http:// jenkins server url :8080/.2. From the Jenkins user interface, select Manage Jenkins, and then select ManagePlugins.3. On the Plugin Manager page, click the Installed tab.4. Check to make sure that HP Fortify Jenkins Plugin version 1.4.30 is listed in the tableof installed plugins.For more information about how to install Jenkins plugins, see the Jenkins Plugin lugins#Plugins-Howtoinstallplugins).Configuring the Jenkins PluginTo configure the Jenkins plugin for use with SSC:1. Open a browser window and navigate to http:// jenkins server url :8080/.2. From the Jenkins user interface, select Manage Jenkins, and then select ConfigureSystem.3. In the HP Fortify Assessment section, do the following:a. In the URL box, type the URL for the SSC server for which you configured theJenkins token type. (The correct format for the Software Security Center URL ishttp://nnn.nnn.nnn.nnn:8080/ssc/.)b. In the Authentication Token box, enter the authentication token generated for theSSC server.4. Click Advanced, and then click Test Connection.The Project Template list is now populated with available SSC project templates. SSCuses the selected project template when it creates new projects.New projects are always of the ‘Basic Remediation Project’ type. So, you must choose aproject template. The project template optimizes the categorization, summarization,and reporting of the project version data.5. From the Project Template list, select the appropriate project template for yourproject.6. Click Save.Note: There is no need to specify a value in the Issue breakdown page size box at this time.You can always change this setting later. This setting controls the Issue Breakdown tableview. The default is 50 issues per page.HP Fortify SoftwareHP Fortify Jenkins Plugin4

Configuring the Build Step to Use for the Jenkins PluginTo configure the build step to use Jenkins plugin:1. From the Jenkins user interface, select the job to view or create a new job.2. On the job page, select Configure.3. On the configuration page that opens for the job, in the Post-build Actions section,select the HP Fortify Assessment check box.4. In the HP Fortify Assessment section, provide or change values for the properties andactions listed in the following table.Note: To see a description of an action or property, click the helpicon to its right.Action orPropertyDescriptionFPR FilenameFPR basename to be published (for example, audit.fpr). If novalue is specified, Jenkins searches "./**/*.fpr" files in theworkspace with the latest modified date.FilterSetFilter set to be used when reading the FPR. If no value isspecified, the default filter is used.SSC, by default, has two filter sets: Security Auditor View andQuick View. Quick View is the default filter set. However, theexact filter set configuration is determined by the projecttemplate used to create the project.Fail condition and NVS calculation depend on the issuesfiltered by the filter set. For example, if some “CriticalExposure” filter is applied to the project issues (and issuesquantity shows 0), then fail condition “sees” no reason to setthis build as “unstable” and NVS is set to 0. The graphsummary also shows 0.Fail ConditionA build is considered unstable if the fail condition is met.To get the unstable build where there is an SQL injection issuein the Hot folder, use the following search string:[fortify priority order]:high category:SQL InjectionThis search string syntax is the same as that used for the SSCsearch and filter functionalities. So, there are some limitationsHP Fortify SoftwareHP Fortify Jenkins Plugin5

Action orPropertyDescriptioncompared to AWB applications. For example, using a regularexpression for a search is not supported.Project NameProject name to be used when uploading FPRs to SSC. Leavingthis field blank disables the upload.Project Version is always used in conjunction with ProjectName.To upload an FPR file to SSC: Project Version and Project Name must be specified. SSC URL and the authentication token must be correctlyspecified.Note: If a project with the specified project name does notexist on SSC, SSC creates it upon the successful build.Enable this plugin and save the configuration. The next timeyou visit this configuration page, a menu populated with allthe available project names is displayed.Alternatively, run the following command to list all availableprojects and their corresponding project IDs:# fortifyclient listprojects -url ssc url /ssc -user your login Project VersionProject version to be used when uploading to SSC. Leaving thisfield blank disables the upload.Project Version is always used in conjunction with ProjectName.To upload an FPR file to SSC:Upload WaitTimeHP Fortify Software Project Version and Project Name must be specified. SSC URL and the authentication token must be correctlyspecified.Because the FPR upload process to SSC is asynchronous, theWebService function call is returned while SSC is stillprocessing the upload request. Therefore, the plugin waits forHP Fortify Jenkins Plugin6