[
https://issues.apache.org/jira/browse/YETUS-441?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16464631#comment-16464631
]
Sean Busbey commented on YETUS-441:
-----------------------------------
here's an example suppression file for hbase that I tested both by specifying
it on the test-patch command line and by adding it as a configuration item in
the hbase project pom.
In both cases, test-patch correctly reports the number of High severity issues
going down:
{code}
+1 overall
____ _
/ ___| _ _ ___ ___ ___ ___ ___| |
\___ \| | | |/ __/ __/ _ \/ __/ __| |
___) | |_| | (_| (_| __/\__ \__ \_|
|____/ \__,_|\___\___\___||___/___(_)
| Vote | Subsystem | Runtime | Comment
============================================================================
| | | | Prechecks
| | | | master Compile Tests
| | | | Patch Compile Tests
| +1 | dependency_check | 3m 11s | The patch generated 0 new + 8
| | | | unchanged - 24 fixed = 8 total (was
| | | | 32)
| | | | Other Tests
| | | 3m 30s |
|| Subsystem || Report/Notes ||
============================================================================
| Optional Tests | dependency_check |
| uname | Darwin Busbey-MBA 15.6.0 Darwin Kernel Version 15.6.0: Tue Jan 30
11:45:51 PST 2018; root:xnu-3248.73.8~1/RELEASE_X86_64 x86_64 |
| Build tool | maven |
| Personality | dev-support/hbase-personality.sh |
| git revision | master / 291dedbf81 |
| maven | version: Apache Maven 3.5.2
(138edd61fd100ec658bfa2d307c43b76940a5d7d; 2017-10-18T02:58:13-05:00) |
| dependency_check | version: |
| modules | C: . U: . |
| Powered by | Apache Yetus 0.8.0-SNAPSHOT http://yetus.apache.org |
============================================================================
============================================================================
Finished build.
============================================================================
============================================================================
{code}
> Add a precommit check for known CVEs from dependencies
> ------------------------------------------------------
>
> Key: YETUS-441
> URL: https://issues.apache.org/jira/browse/YETUS-441
> Project: Yetus
> Issue Type: New Feature
> Components: Test Patch
> Reporter: Sean Busbey
> Assignee: Sean Busbey
> Priority: Major
> Attachments: YETUS-441.0.patch, YETUS-441.1.patch,
> dependency-check-suppression.xml
>
>
> Add in a precommit test that makes use of [The OWASP Dependency
> Check|https://www.owasp.org/index.php/OWASP_Dependency_Check] to look for
> known bad dependencies.
> there's a maven plugin, ant task, and command line tool. So we should be able
> to build similar support to what we have for RAT.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
