Skip to content

Commit 068ed0c

Browse files
stIncMalestIncMale
committed
Create and upload ssdlc_compliance_report.md
JAVA-5435
1 parent 2412cbd commit 068ed0c

File tree

3 files changed

+183
-18
lines changed

3 files changed

+183
-18
lines changed

‎.evergreen/.evg.yml

Lines changed: 52 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,45 @@ functions:
142142
content_type: ${content_type|text/plain}
143143
display_name: "orchestration.log"
144144

145+
"create and upload SSDLC release assets":
146+
- command: shell.exec
147+
shell: "bash"
148+
params:
149+
working_dir: "src"
150+
env:
151+
PRODUCT_NAME: ${product_name}
152+
PRODUCT_VERSION: ${product_version}
153+
script: .evergreen/ssdlc-report.sh
154+
- command: ec2.assume_role
155+
params:
156+
role_arn: ${UPLOAD_SSDLC_RELEASE_ASSETS_ROLE_ARN}
157+
- command: s3.put
158+
params:
159+
aws_key: ${AWS_ACCESS_KEY_ID}
160+
aws_secret: ${AWS_SECRET_ACCESS_KEY}
161+
aws_session_token: ${AWS_SESSION_TOKEN}
162+
local_file: ./src/build/ssdlc/ssdlc_compliance_report.md
163+
remote_file: ${product_name}/${product_version}/ssdlc_compliance_report.md
164+
bucket: java-driver-release-assets
165+
region: us-west-1
166+
permissions: private
167+
content_type: text/markdown
168+
display_name: ssdlc_compliance_report.md
169+
- command: s3.put
170+
params:
171+
aws_key: ${AWS_ACCESS_KEY_ID}
172+
aws_secret: ${AWS_SECRET_ACCESS_KEY}
173+
aws_session_token: ${AWS_SESSION_TOKEN}
174+
local_files_include_filter:
175+
- build/ssdlc/static-analysis-reports/*.sarif
176+
local_files_include_filter_prefix: ./src/
177+
remote_file: ${product_name}/${product_version}/static-analysis-reports/
178+
bucket: java-driver-release-assets
179+
region: us-west-1
180+
permissions: private
181+
content_type: application/sarif+json
182+
display_name:
183+
145184
"upload test results":
146185
- command: attach.xunit_results
147186
params:
@@ -825,24 +864,21 @@ functions:
825864
params:
826865
working_dir: "src"
827866
script: |
828-
tag=$(git describe --tags --always --dirty)
829-
830-
# remove the leading 'r'
831-
version=$(echo -n "$tag" | cut -c 2-)
832-
833-
cat <<EOT > trace-expansions.yml
834-
release_version: "$version"
835-
EOT
836-
cat trace-expansions.yml
867+
PRODUCT_VERSION="$(echo -n "$(git describe --tags --always --dirty)" | cut -c 2-)"
868+
cat > ssdlc-expansions.yml <<EOF
869+
product_version: "$PRODUCT_VERSION"
870+
product_name: "${product_name}"
871+
EOF
872+
cat ssdlc-expansions.yml
837873
- command: expansions.update
838874
params:
839-
file: src/trace-expansions.yml
875+
file: src/ssdlc-expansions.yml
840876
- command: papertrail.trace
841877
params:
842878
key_id: ${papertrail_key_id}
843879
secret_key: ${papertrail_secret_key}
844-
product: ${product}
845-
version: ${release_version}
880+
product: ${product_name}
881+
version: ${product_version}
846882
filenames:
847883
- "src/build/repo/org/mongodb/*/*/*.jar"
848884
- "src/build/repo/org/mongodb/*/*/*.pom"
@@ -1580,15 +1616,17 @@ tasks:
15801616
- func: "publish snapshot"
15811617
- func: "trace artifacts"
15821618
vars:
1583-
product: mongo-java-driver-snapshot
1619+
product_name: mongo-java-driver-snapshot
1620+
- func: "create and upload SSDLC release assets"
15841621

15851622
- name: publish-release
15861623
git_tag_only: true
15871624
commands:
15881625
- func: "publish release"
15891626
- func: "trace artifacts"
15901627
vars:
1591-
product: mongo-java-driver
1628+
product_name: mongo-java-driver
1629+
- func: "create and upload SSDLC release assets"
15921630

15931631
- name: "perf"
15941632
tags: ["perf"]

‎.evergreen/ssdlc-report.sh

Lines changed: 49 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,59 @@
22

33
set -o errexit
44

5+
# Supported/used environment variables:
6+
# PRODUCT_NAME
7+
# PRODUCT_VERSION
8+
9+
if [ -z "${PRODUCT_NAME}" ]; then
10+
echo "PRODUCT_NAME must be set to a non-empty string"
11+
exit 1
12+
fi
13+
if [ -z "${PRODUCT_VERSION}" ]; then
14+
echo "PRODUCT_VERSION must be set to a non-empty string"
15+
exit 1
16+
fi
17+
518
############################################
619
# Main Program #
720
############################################
821
RELATIVE_DIR_PATH="$(dirname "${BASH_SOURCE[0]:-$0}")"
922
source "${RELATIVE_DIR_PATH}/javaConfig.bash"
1023

11-
echo "Creating SSLDC reports"
24+
printf "\nCreating SSDLC reports\n"
25+
26+
declare -r SSDLC_PATH="${RELATIVE_DIR_PATH}/../build/ssdlc"
27+
declare -r SSDLC_STATIC_ANALYSIS_REPORTS_PATH="${SSDLC_PATH}/static-analysis-reports"
28+
mkdir "${SSDLC_PATH}"
29+
mkdir "${SSDLC_STATIC_ANALYSIS_REPORTS_PATH}"
30+
31+
printf "\nCreating SpotBugs SARIF reports\n"
1232
./gradlew -version
13-
./gradlew -PssdlcReport.enabled=true --continue -x test -x integrationTest -x spotlessApply clean check scalaCheck kotlinCheck testClasses || true
14-
echo "SpotBugs created the following SARIF files"
15-
find . -path "*/spotbugs/*.sarif"
33+
./gradlew -PssdlcReport.enabled=true --continue -x test -x integrationTest -x spotlessApply check scalaCheck kotlinCheck || true
34+
printf "\nSpotBugs created the following SARIF reports\n"
35+
IFS=$'\n'
36+
declare -a SARIF_PATHS=($(find "${RELATIVE_DIR_PATH}/.." -path "*/spotbugs/*.sarif"))
37+
unset IFS
38+
for SARIF_PATH in "${SARIF_PATHS[@]}"; do
39+
GRADLE_PROJECT_NAME="$(basename "$(dirname "$(dirname "$(dirname "$(dirname "${SARIF_PATH}")")")")")"
40+
NEW_SARIF_PATH="${SSDLC_STATIC_ANALYSIS_REPORTS_PATH}/${GRADLE_PROJECT_NAME}_$(basename "${SARIF_PATH}")"
41+
cp "${SARIF_PATH}" "${NEW_SARIF_PATH}"
42+
printf "%s\n" "${NEW_SARIF_PATH}"
43+
done
44+
45+
printf "\nCreating SSDLC compliance report\n"
46+
declare -r TEMPLATE_SSDLC_REPORT_PATH="${RELATIVE_DIR_PATH}/../template_ssdlc_compliance_report.md"
47+
declare -r SSDLC_REPORT_PATH="${SSDLC_PATH}/ssdlc_compliance_report.md"
48+
cp "${TEMPLATE_SSDLC_REPORT_PATH}" "${SSDLC_REPORT_PATH}"
49+
declare -a SED_EDIT_IN_PLACE_OPTION
50+
if [[ "$OSTYPE" == "darwin"* ]]; then
51+
SED_EDIT_IN_PLACE_OPTION=(-i '')
52+
else
53+
SED_EDIT_IN_PLACE_OPTION=(-i)
54+
fi
55+
sed "${SED_EDIT_IN_PLACE_OPTION[@]}" \
56+
-e "s/\${product_name}/${PRODUCT_NAME}/g" \
57+
-e "s/\${product_version}/${PRODUCT_VERSION}/g" \
58+
-e "s/\${report_date_utc}/$(date -u +%Y-%m-%d)/g" \
59+
"${SSDLC_REPORT_PATH}"
60+
ls "${SSDLC_REPORT_PATH}"

‎template_ssdlc_compliance_report.md

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# ${product_name} SSDLC compliance report
2+
3+
This report is available at
4+
<https://d-9067613a84.awsapps.com/start/#/console?account_id=857654397073&role_name=Drivers.User&destination=https%3a%2f%2fus-west-1.console.aws.amazon.com%2fs3%2fobject%2fjava-driver-release-assets%3fregion%3dus-west-1%26bucketType%3dgeneral%26prefix%3d${product_name}%2f${product_version}%2fssdlc_compliance_report.md>.
5+
6+
<table>
7+
<tr>
8+
<th>Product name</th>
9+
<td><a href="https://github.com/mongodb/mongo-java-driver">${product_name}</a></td>
10+
</tr>
11+
<tr>
12+
<th>Product version</th>
13+
<td>${product_version}</td>
14+
</tr>
15+
<tr>
16+
<th>Report date, UTC</th>
17+
<td>${report_date_utc}</td>
18+
</tr>
19+
</table>
20+
21+
## Release creator
22+
23+
This information is available in multiple ways:
24+
25+
<table>
26+
<tr>
27+
<th>Evergreen</th>
28+
<td>
29+
Go to
30+
<a href="https://evergreen.mongodb.com/waterfall/mongo-java-driver?bv_filter=Publish%20Release">
31+
https://evergreen.mongodb.com/waterfall/mongo-java-driver?bv_filter=Publish%20Release</a>,
32+
find the build triggered from Git tag <code>r${product_version}</code>, see who authored it.
33+
</td>
34+
</tr>
35+
<tr>
36+
<th>Papertrail, human-readable</th>
37+
<td>
38+
Go to
39+
<a href="https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}">
40+
https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}</a>,
41+
look at the value in the "Submitter" column.
42+
</td>
43+
</tr>
44+
<tr>
45+
<th>Papertrail, JSON</th>
46+
<td>
47+
Go to
48+
<a href="https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}&format=json">
49+
https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}&format=json</a>
50+
and loot at the value associated with the <code>submitter</code> key.
51+
</td>
52+
</tr>
53+
</table>
54+
55+
## Process document
56+
57+
Blocked on <https://jira.mongodb.org/browse/JAVA-5429>.
58+
59+
The MongoDB SSDLC policy is available at
60+
<https://docs.google.com/document/d/1u0m4Kj2Ny30zU74KoEFCN4L6D_FbEYCaJ3CQdCYXTMc>.
61+
62+
## Third-darty dependency information
63+
64+
There are no dependencies to report vulnerabilities of.
65+
Our [SBOM](https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/docs/CYCLONEDX/) lite
66+
is <https://github.com/mongodb/mongo-java-driver/blob/r${product_version}/sbom.json>.
67+
68+
## Static analysis findings
69+
70+
The static analysis findings are all available at
71+
<https://d-9067613a84.awsapps.com/start/#/console?account_id=857654397073&role_name=Drivers.User&destination=https%3a%2f%2fus-west-1.console.aws.amazon.com%2fs3%2fobject%2fjava-driver-release-assets%3fregion%3dus-west-1%26bucketType%3dgeneral%26prefix%3d${product_name}%2f${product_version}%2fstatic-analysis-reports%2f>.
72+
All the findings in the aforementioned reports
73+
are either of the MongoDB status "False Positive" or "No Fix Needed",
74+
because code that has any other findings cannot technically get into the product.
75+
76+
<https://github.com/mongodb/mongo-java-driver/blob/r${product_version}/config/spotbugs/exclude.xml> may also be of interest.
77+
78+
## Signature information
79+
80+
The product artifacts are signed.
81+
The signatures can be verified by following instructions at
82+
<https://github.com/mongodb/mongo-java-driver/releases/tag/r${product_version}>.

0 commit comments

Comments
 (0)