[Project] DevSecOps 프로젝트 - SAST 분석 및 활용

$ wget https://dl.bintray.com/jeremy-long/owasp/dependency-check-5.2.4-release.zip
$ unzip dependency-check-5.2.4-release.zip
$ mv dependency-check/ /var/lib/jenkins

$ /var/lib/jenkins/dependency-check/bin/dependency-check.sh --scan `pwd` --format HTML --out /var/lib/jenkins/reports/dependency-check-report --prettyPrint

<plugin>
    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-maven-plugin</artifactId>
    <version>3.1.12.2</version>
    <configuration>
        <effort>Max</effort>
        <threshold>Low</threshold>
        <failOnError>true</failOnError>
        <plugins>
            <plugin>
                <groupId>com.h3xstream.findsecbugs</groupId>
                <artifactId>findsecbugs-plugin</artifactId>
                <version>1.10.1</version>
            </plugin>
        </plugins>
    </configuration>
    <executions>
        <execution>
            <id>scan</id>
            <phase>verify</phase>
            <goals>
                <goal>check</goal>
            </goals>
        </execution>
    </executions>
</plugin>

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-checkstyle-plugin</artifactId>
    <version>2.17</version>
    <executions>
        <execution>
            <id>validate</id>
            <phase>validate</phase>
            <configuration>
                <configLocation>google_checks.xml</configLocation>
                <suppressionsLocation>suppressions.xml
                </suppressionsLocation>
                <encoding>UTF-8</encoding>
                <failsOnError>true</failsOnError>
                <consoleOutput>true</consoleOutput>
                <includeTestSourceDirectory>true
                </includeTestSourceDirectory>
            </configuration>
            <goals>
                <goal>check</goal>
            </goals>
        </execution>
    </executions>
</plugin>

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-pmd-plugin</artifactId>
    <version>3.13.0</version>
    <executions>
        <execution>
            <id>pmd-scan</id>
            <phase>verify</phase>
            <goals>
                <goal>check</goal>
            </goals>
        </execution>
    </executions>
</plugin>

$ docker run --restart=always -d -p 9000:9000 -p 9092:9092 --name sonarqube sonarqube

$ vim /usr/local/maven/conf/settings.xml
<settings>
    <pluginGroups>
        <pluginGroup>org.sonarsource.scanner.maven</pluginGroup>
    </pluginGroups>
    <profiles>
        <profile>
            <id>sonar</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <properties>
                <!-- Optional URL to server. Default value is http://localhost:9000 -->
                <sonar.host.url>
                http://JENKINS_SERVER_IP:9000
                </sonar.host.url>
            </properties>
        </profile>
    </profiles>
</settings>

$ mvn clean verify sonar:sonar

crisis51526@cloudshell:~ (cccr-nov2)$ kubectl create namespace anchore
nameanchore created

crisis51526@cloudshell:~ (cccr-nov2)$ helm repo add anchore https://charts.anchore.io
"anchore" has been added to your repositories
crisis51526@cloudshell:~ (cccr-nov2)$ helm install anchore anchore/anchore-engine -n anchore
NAME: anchore
LAST DEPLOYED: Sat Oct 20 18:06:18 2020
NAMESPACE: anchore
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
To use Anchore Engine you need the URL, username, and password to access the API.

Anchore Engine can be accessed via port 8228 on the following DNS name from within the cluster:
anchore-anchore-engine-api.anchore.svc.cluster.local

Here are the steps to configure the anchore-cli (`pip install anchorecli`). Use these same values for direct API access as well.

To configure your anchore-cli run:

    ANCHORE_CLI_USER=admin
    ANCHORE_CLI_PASS=$(kubectl get secret --namespace anchore anchore-anchore-engine -o jsonpath="{.data.ANCHORE_ADMIN_PASSWORD}" | base64 --decode; echo)

Using the service endpoint from within the cluster you can use:
    ANCHORE_CLI_URL=http://anchore-anchore-engine-api.anchore.svc.cluster.local:8228/v1/


To verify the service is up and running, you can run container for the Anchore Engine CLI:

    kubectl run -i --tty anchore-cli --restart=Always --image anchore/engine-cli  --env ANCHORE_CLI_USER=admin --env ANCHORE_CLI_PASS=${ANCHORE_CLI_PASS} --env ANCHORE_CLI_URL=http://anchore-anchore-engine-api.anchore.svc.cluster.local:8228/v1/

from within the container you can use 'anchore-cli' commands.

* NOTE: On first startup of anchore-engine, it performs a CVE data sync which may take several minutes to complete. During this time the system status will report 'partially_down' and any images added for analysis will stay in the 'not_analyzed' state.
Once the sync is complete, any queued images will be analyzed and the system status will change to 'all_up'.

Initial setup time can be >120sec for postgresql setup and readiness checks to pass for the services as indicated by pod state. You can check with:
    kubectl get pods -l app=anchore-anchore-engine,component=api

A quick primer on using the Anchore Engine CLI follows. For more info see: https://github.com/anchore/anchore-engine/wiki/Getting-Started

View system status:

    anchore-cli system status

Add an image to be analyzed:

    anchore-cli image add <imageref>

List images and see the analysis status (not_analyzed initially):

    anchore-cli image list

Once the image is analyzed you'll see status change to 'analyzed'. This may take some time on first execution with a new database because
the system must first do a CVE data sync which can take several minutes. Once complete, the image will transition to 'analyzing' state.

When the image reaches 'analyzed' state, you can view policy evaluation output with:

    anchore-cli evaluate check <imageref>

List CVEs found in the image with:

    anchore-cli image vuln <imageref> os

List OS packages found in the image with:
    anchore-cli image content <imageref> os

List files found in the image with:
    anchore-cli image content <imageref> files

$ yum install -y epel-release
$ yum install -y python-pip
$ pip install anchorecli
$ export ANCHORE_CLI_USER=admin
$ export ANCHORE_CLI_PASS=foobar
$ export ANCHORE_CLI_URL=http://ANCHORE_IP:30228/v1

crisis51526@cloudshell:~/anchore-engine (cccr-nov2)$ export ANCHORE_CLI_PASS=$(kubectl get secret --namespace anchore anchore-anchore-engine -o jsonpath="{.data.ANCHORE_ADMIN_PASSWORD}" | base64 --decode; echo)
crisis51526@cloudshell:~/anchore-engine (cccr-nov2)$ echo $ANCHORE_CLI_PASS
foobar

crisis51526@cloudshell:~/anchore-engine (cccr-nov2)$ vim anchore-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
name: anchore-api
spec:
type: NodePort
selector:
    app: anchore-anchore-engine
    component: api
ports:
    - protocol: TCP
    port: 8228
    targetPort: 8228
    nodePort: 30228

crisis51526@cloudshell:~/anchore-engine (cccr-nov2)$ kubectl create -f anchore-nodeport.yaml -n anchore
service/anchore-api created

[root@jenkins cccr-dvwa]# anchore-cli image add jisunpark/cccr-dvwa-java-web --dockerfile=Dockerfile --force
Image Digest: sha256:fec038ff428898223fc9fb516caedbf52c4572f2e491590d8f5647e8e5d787c9
Parent Digest: sha256:fec038ff428898223fc9fb516caedbf52c4572f2e491590d8f5647e8e5d787c9
Analysis Status: not_analyzed
Image Type: docker
Analyzed At: 2020-10-20T18:43:29Z
Image ID: 85a4a0ea97867479bcb328c7a6c75691434d36ea0a0b75e6e453b22ff0f6fc7d
Dockerfile Mode: Actual
Distro: debian
Distro Version: 10
Size: 920176640
Architecture: amd64
Layer Count: 16

Full Tag: docker.io/jisunpark/cccr-dvwa-java-web:latest
Tag Detected At: 2020-10-20T18:40:33Z

properties([
    parameters([
        string(name: 'sonar.projectKey', defaultValue: 'cccr-dvwa'),
        string(name: 'sonar.host.url', defaultValue: 'http://JENKINS_SERVER_IP:9000'),
        string(name: 'sonar.login', defaultValue: '265c24760ec4f5cf1f28b87981c7bbe55c3bdffc'),
    ]) 
])
pipeline {
    environment {
        SLACK_CHANNEL = '#send-slack-message-from-jenkins'
        REGISTRY = 'crisis513/cccr-dvwa-java-web' 
        REGISTRYCREDENTIAL = 'dockerhub' 
        DOCKER_IMAGE = ''
    }
    agent any
    tools { 
        maven 'mvn' 
    }
    stages {
        stage('Git clone') {
            steps {
                git 'https://github.com/JisunParkRea/cccr-dvwa.git'
            }
        }
        stage('Docker image build and push to Dockerhub') { 
            steps{
                script {
                    DOCKER_IMAGE = docker.build registry
                    docker.withRegistry('', REGISTRYCREDENTIAL) {
                        DOCKER_IMAGE.push("latest")
                    }
                }
            }
        } 
        stage('Anchore Analysis') {
            steps {
                sh 'echo "$REGISTRY:latest `pwd`/Dockerfile" > anchore_images'
                anchore name: 'anchore_images'
            }
        }
        stage('Clean local docker image') {
            agent any
                steps { 
                sh 'docker rmi $REGISTRY:latest'
            } 
        }
        stage ('Static Analysis(PMD, SpotBugs, CheckStyle)') {
            steps {
                sh 'mvn pmd:pmd spotbugs:spotbugs checkstyle:checkstyle'
            }
        }
        stage ('Dependency-Check Analysis') {
            steps {
                sh '/var/lib/jenkins/dependency-check/bin/dependency-check.sh --scan `pwd` --format HTML --out /var/lib/jenkins/reports/dependency-check-report --prettyPrint'
            }
        }
        stage('Sonarqube and Quality gate') {
            options {
                timeout(time: 5, unit: 'MINUTES')
                retry(2)
            }
            steps {
                withSonarQubeEnv('SonarQube Server') {
                    sh "mvn sonar:sonar"
                }
                script {
                    qualitygate = waitForQualityGate()
                    if (qualitygate.status != "OK") {
                        currentBuild.result = "FAILURE"
                        slackSend (channel: $SLACK_CHANNEL, color: '#F01717', message: "*$JOB_NAME*, <$BUILD_URL|Build #$BUILD_NUMBER>")
                    }
                }
            }
        }
    }
    post { 
        success { 
            slackSend (channel: $SLACK_CHANNEL, color: '#00FF00', message: "SUCCESSFUL: Job '${env.JOB_NAME} [${env.BUILD_NUMBER}]' (${env.BUILD_URL})") 
        }
        failure {
            slackSend (channel: $SLACK_CHANNEL, color: '#F01717', message: "FAILURE: '${env.JOB_NAME} [${env.BUILD_NUMBER}]' (${env.BUILD_URL})")
        }
    }
}