强化命令行使用
有人使用命令行来运行 fortify 吗？ 我尝试将 fortify run 合并到我的 CI 构建中，但我不知道该怎么做。
Has anyone used command line to run fortify?
I tryin to incorporate fortify run in my CI build and I dont know how to do it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
由于我无法添加评论，因此我必须将此作为答案。我们公司已将扫描过程集成到我们的 TFS 构建环境中，并且运行良好。
我们使用一系列“调用流程”构建活动来实现这一点。整个安全扫描序列包含在一个条件中，该条件作为构建定义的参数公开。这允许我们根据需要启用或禁用扫描。我们还公开了一些其他内容，例如 Fortify 项目、Fortify 项目版本以及上传 FPR 文件的另一个条件。
其要点是：
Clean
sourceanalyzer -b "Build ID" -cleanBuild
sourceanalyzer -b "Build ID" devenv BuildID.sln /Rebuild Debug /out "C:\SSCLogs\SSCBuild.log"扫描
sourceanalyzer -b "Build ID" -scan -format fpr -f BuildID.fpr上传到SSC
fortifyclient.bat -url SSCServerUrl -authtoken XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX uploadFPR -file BuildID.fpr -project "MyProject" -version "MyProject v1 .0.0"如果您想要完整的概要和/或一些屏幕截图，我很乐意为您提供一些东西。
Since I can't add a comment, I'll have to offer this as an answer. Our company has integrated the scan process into our TFS build environment and it works pretty well.
We use a series of "Invoke Process" build activities to make this happen. The entire security scan sequence is wrapped in a conditional which is exposed as an argument to the build definition. This allows us to enable or disable scans as needed. We also expose a few other things like Fortify Project, Fortify Project Version, and another conditional for uploading the FPR file.
The gist of it is this:
Clean
sourceanalyzer -b "Build ID" -cleanBuild
sourceanalyzer -b "Build ID" devenv BuildID.sln /Rebuild Debug /out "C:\SSCLogs\SSCBuild.log"Scan
sourceanalyzer -b "Build ID" -scan -format fpr -f BuildID.fprUpload to SSC
fortifyclient.bat -url SSCServerUrl -authtoken XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX uploadFPR -file BuildID.fpr -project "MyProject" -version "MyProject v1.0.0"If you'd like a full rundown and/or some screen captures, I'd be happy to provide something for you.
典型扫描的命令如下所示。
使用
sourceanalyzer -b使用
sourceanalyzer -b-scan -f.fpr （如果您使用的是 360 服务器）使用
fortifyclient uploadFPR -f.fpr -project-version <版本名称> -urlhttps://fortify.com/f360 -user <用户名>; -密码<密码>; /// 但是，我请求有关构建标签的帮助。当我们调用 SCA 时，我们可以为其分配构建标签。但是我不确定要为命令提供哪些选项。
sourceanalyzer -b testid codebase -build-label如果有人知道格式，请告诉我。
The commands for a typical scan would look something like this.
sourceanalyzer -b <build ID> <sourcecode>sourceanalyzer -b <build ID> -scan -f <test>.fprfortifyclient uploadFPR -f <test>.fpr -project <projectname> -version <versionname> -urlhttps://fortify.com/f360 -user <username> -password <password> /// <authtoken>However, I request help with the build labels. When we invoke SCA, we can assign a build label to it. However I am not sure what options to provide to the commands.
sourceanalyzer -b testid codebase -build-label <option>If anyone know the format of the please do let me know.
Fortify 有一个静态代码分析工具，sourceanalyzer。该工具基于命令行，因此应该可以集成到 CI 系统中。
如上所述，您可以使用帮助选项或查看涵盖多种语言和选项的文档/用户指南（名为：HP Fortify 静态代码分析器用户指南）。
您可能需要考虑的一点是在 CI 场景中执行此类扫描的速度和资源利用率。您可能需要考虑在夜间或非高峰时段运行此程序。该文档指出该工具使用了大量的内存。
您可能还需要弄清楚如何处理 sourceanalyzer 工具生成的输出 fpr 文件。例如，您可以将其作为 Team City 中的工件，并将其手动上传到 Fortify 服务器或与 Fortify 工作台产品一起使用。我想您也可以喜欢并自动上传到 Fortify 服务器。
Fortify has a static code analyzer tool, sourceanalyzer. This tool is command line based, and as such, should be something that you could integrate into a CI system.
As mentioned above, you can use the help option or review the documentation/user guide (named: HP Fortify Static Code Analyzer User Guide) which covers many languages and options.
One point you may need to consider is the speed and resource utilization of performing a such a scan in a CI scenario. You may need to consider running this over night or during off peak hours. The documentation states that the tool uses a decent amount of memory.
You may also have to figure out how to process the output fpr file that the sourceanalyzer tool produces. For example, you could make this an artifact in Team City and upload it manually to a Fortify server or use with the Fortify workbench product. I would imagine you could also get fancy and automate the upload into Fortify server.
这里的答案非常好，我想补充一点，您可以在扫描时添加日志记录，这非常有帮助。
带日志记录的扫描
sourceanalyzer -b "Build ID" -scan -format fpr -f BuildID.fpr -debug -verbose -logfile "C:\logfile.txt"
Very good answers here, i would like to add that you can add logging while scanning this very helpful.
SCAN with Logging
sourceanalyzer -b "Build ID" -scan -format fpr -f BuildID.fpr -debug -verbose -logfile "C:\logfile.txt"
如果您在帮助文本中没有看到适当的构建命令，请告诉我们。现实世界中 99% 的调用都在那里。
根据您尝试构建的源代码类型，可以使用数十种不同的命令行开关和技术。
我建议您首先获取 SCA 用户指南。这是一个 PDF 文档，您可以从为您提供 Fortify 安装程序的人员处获取。
Let us know if you don't see the appropriate build command in the help text. 99% of the real world invocations are there.
Depending on what kind of source code you are trying to build, there are dozens of different command line switches and techniques to use.
I recommend you start by obtaining the SCA User Guide. It is a PDF document you can obtain from whoever provided you the Fortify installer.
在我的公司，我们创建了一个 docker 映像来管理 CI 流程中的 Fortify 命令。
基本上，我们开发了一个 python 脚本来帮助我们集中扫描，然后在 GitlabCI 的工作中调用此图像 docker。
正如他们所解释的，sourceanalyzer 是执行扫描的工具，我们使用 cloudscan 工具连接 SCC 并下载扫描并检查分析的状态。
我们还使用：
目前我们使用 fortify 19.10。
At my company, we created a docker image to manage Fortify commands in the CI process.
Basically, we developed a python script to help us keep the scan centralized and then call this image docker in a job at GitlabCI.
As the guys explained, sourceanalyzer is the tool to do the scans and we use the cloudscan tool to connect with the SCC and download the scans and check the status of the analysis.
We also use:
Currently we use fortify 19.10.