Skip to content

feat: enabled vulnerability report with asset-descriptor #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open

feat: enabled vulnerability report with asset-descriptor #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
0725aa7
feat: enabled vulnerability report with asset-descriptor
rmtrms Dec 9, 2024
8f1ccdf
feat: reenabled vulnerability report
rmtrms Jan 23, 2025
02ad70e
feat: enabled annex
rmtrms Jan 23, 2025
6f0c7d6
fix: removed HEAD-SNAPSHOT
rmtrms Jan 23, 2025
f16617a
fix: added HEAD-SNAPSHOT again since required features are not releas…
rmtrms Jan 23, 2025
67c26fe
feat: enabled vulnerability report with new asset descriptor structure
rmtrms Feb 13, 2025
a62c8b5
feat: enabled annex with new asset descriptor structure
rmtrms Feb 13, 2025
a0cccbe
feat: enabled annex and vulnerability report with asset descriptor st…
rmtrms Feb 14, 2025
391a10a
feat: removed reportContextTitle, reportContext from assetDescriptor,…
rmtrms Feb 19, 2025
2d487a5
feat: made document params optional; enabled default settings for tar…
rmtrms Feb 19, 2025
0b10b4f
chore: added double quotes
rmtrms Feb 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 21 additions & 42 deletions documents/annexes/ae-annex/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,12 +45,12 @@

<build>
<plugins>
<plugin>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-inventory-maven-plugin</artifactId>
<executions>
<!-- FIXME: re-enable or split into several documents -->
<!--<execution>
<!-- <plugin>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-inventory-maven-plugin</artifactId>
<executions> -->
<!-- FIXME: re-enable or split into several documents -->
<!-- <execution>
<id>create-ae-container-report</id>
<goals>
<goal>create-inventory-report</goal>
Expand All @@ -63,49 +63,28 @@
<targetReportDir>${basedir}/src/main/dita/ae-container/gen</targetReportDir>
</configuration>
</execution>
-->
</executions>
</plugin> -->


<plugin>
<groupId>com.metaeffekt.artifact.analysis</groupId>
<artifactId>ae-asset-descriptor-maven-plugin</artifactId>
<version>${ae.artifact.analysis.version}</version>
<executions>
<execution>
<id>create-ae-dependency-inventory</id>
<id>default-descriptor</id>
<goals>
<goal>create-inventory-report</goal>
<goal>generate-documents</goal>
</goals>
<phase>process-sources</phase>
<configuration>
<sourceInventoryDir>${project.build.directory}/inventory-base</sourceInventoryDir>
<sourceInventoryIncludes>**/*.xls</sourceInventoryIncludes>
<inventory>${project.build.directory}/inventories/inventory/ae-dependency-extractor-inventory.xls</inventory>
<targetReportDir>${basedir}/src/main/dita/ae-dependency/gen</targetReportDir>
<assetDescriptorFile>${project.basedir}/src/main/asset-descriptor/asset-descriptor.yaml</assetDescriptorFile>

<targetReportDir>${project.basedir}/src/main/dita/ae-dependency/gen</targetReportDir>
</configuration>
</execution>
</executions>

<configuration>
<failOnBanned>${annex.validation}</failOnBanned>
<failOnError>${annex.validation}</failOnError>
<failOnUnknown>${annex.validation}</failOnUnknown>
<failOnUnknownVersion>${annex.validation}</failOnUnknownVersion>
<failOnMissingLicense>${annex.validation}</failOnMissingLicense>
<failOnMissingLicenseFile>${annex.validation}</failOnMissingLicenseFile>
<failOnMissingNotice>${annex.validation}</failOnMissingNotice>
<failOnDevelopment>${annex.validation}</failOnDevelopment>
<failOnInternal>${annex.validation}</failOnInternal>

<failOnUpgrade>false</failOnUpgrade>
<failOnDowngrade>false</failOnDowngrade>

<relativeLicensePath>licenses</relativeLicensePath>

<targetLicenseDir>${project.build.directory}/licenses</targetLicenseDir>
<targetComponentDir>${project.build.directory}/components</targetComponentDir>

<targetReportDir>${basedir}/src/main/dita/${project.artifactId}/gen</targetReportDir>

<securityPolicyFile>${project.basedir}/../../security-policy-report.json</securityPolicyFile>

<enableBomReport>true</enableBomReport>
</configuration>

</plugin>

<plugin>
Expand Down Expand Up @@ -145,7 +124,7 @@
</goals>
<configuration>
<ditaSourceDir>${project.basedir}/src/main/dita/ae-dependency</ditaSourceDir>
<ditaSourceGenDir>${project.basedir}/src/main/dita/ae-dependency/gen</ditaSourceGenDir>
<ditaSourceGenDir>${project.basedir}/src/main/dita/ae-dependency/gen/ae-dependency-extractor</ditaSourceGenDir>
</configuration>
</execution>

Expand Down Expand Up @@ -345,7 +324,7 @@
</goals>
<configuration>
<files>
<file>${project.basedir}/src/main/dita/ae-dependency/gen/inventory-report.properties</file>
<file>${project.basedir}/src/main/dita/ae-dependency/gen/ae-dependency-extractor/inventory-report.properties</file>
</files>
</configuration>
</execution>
Expand Down
20 changes: 20 additions & 0 deletions documents/annexes/ae-annex/src/main/asset-descriptor/asset-descriptor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
inventories:
- "ae-dependency-extractor":
file: "../../../target/inventories/inventory/ae-dependency-extractor-inventory.xls"
type: INPUT

documents:
"annex":
type: ANNEX
language: "en"
params:
securityPolicyFile: "security-policy-report.json"
parts:
"annex":
type: ANNEX
inventories:
- inventoryRef: "ae-dependency-extractor"
assetName: "ae-dependency"
assetVersion: "1.0"


9 changes: 1 addition & 8 deletions documents/annexes/ae-annex/src/main/dita/bill-of-materials.ditamap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,7 @@
<topicref href="ae-common-content/bill-of-materials/en/tpc_no-import-export-information.dita" />
</chapter>

<chapter href="ae-dependency/tpc_bill-of-materials.dita">
<topicref href="ae-dependency/gen/tpc_inventory-artifact-report-effective.dita" />
<topicref href="ae-dependency/gen/tpc_inventory-webmodule-report-effective.dita" />
<topicref href="ae-dependency/gen/tpc_inventory-package-report-effective.dita" />
<topicref href="ae-dependency/gen/tpc_inventory-licenses-effective.dita" />
<topicref href="ae-dependency/gen/tpc_inventory-license-usage.dita" />
<topicref href="ae-dependency/gen/tpc_inventory-component-license-details.dita" keys="license-notices" />
</chapter>
<chapter format="ditamap" href="ae-dependency/gen/map_annex-document.ditamap" />

<backmatter>
<booklists>
Expand Down
4 changes: 2 additions & 2 deletions documents/annexes/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
<configuration>
<artifactExcludes>-nothing-</artifactExcludes>

<enableDita>true</enableDita>
<!-- <enableDita>true</enableDita> -->

<failOnError>${annex.validation}</failOnError>
<failOnBanned>${annex.validation}</failOnBanned>
Expand All @@ -55,7 +55,7 @@
<targetLicenseDir>${project.build.directory}/annex/licenses</targetLicenseDir>
<targetComponentDir>${project.build.directory}/annex/components</targetComponentDir>

<targetDitaPath>${basedir}/src/main/dita/${project.artifactId}/gen</targetDitaPath>
<!-- <targetDitaPath>${basedir}/src/main/dita/${project.artifactId}/gen</targetDitaPath> -->
</configuration>
</plugin>

Expand Down
59 changes: 10 additions & 49 deletions documents/reports/example-report/pom.xml
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>

<parent>
Expand Down Expand Up @@ -73,8 +73,8 @@
<overWriteSnapshots>true</overWriteSnapshots>
</configuration>
</execution>
</executions>
</plugin>
</executions>
</plugin>

<plugin>
<groupId>com.metaeffekt.artifact.analysis</groupId>
Expand Down Expand Up @@ -115,67 +115,28 @@
</plugin>

<plugin>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-inventory-maven-plugin</artifactId>
<groupId>com.metaeffekt.artifact.analysis</groupId>
<artifactId>ae-asset-descriptor-maven-plugin</artifactId>
<version>${ae.artifact.analysis.version}</version>
<executions>
<execution>
<id>create-report-ae</id>
<id>default-descriptor</id>
<goals>
<goal>create-inventory-report</goal>
<goal>generate-documents</goal>
</goals>
<phase>process-sources</phase>
<configuration>
<sourceInventoryDir>${project.build.directory}/inventories/inventory</sourceInventoryDir>
<sourceInventoryIncludes>${project.artifactId}-summary.xlsx</sourceInventoryIncludes>
<inventory>${project.build.directory}/inventories/inventory/${project.artifactId}-summary.xlsx</inventory>
<targetReportDir>${basedir}/src/main/dita/${project.artifactId}/gen</targetReportDir>
<assetDescriptorFile>${project.basedir}/src/main/asset-descriptor/asset-descriptor.yaml</assetDescriptorFile>

<targetReportDir>${project.basedir}/src/main/dita/${project.artifactId}/gen</targetReportDir>
</configuration>
</execution>
</executions>

<configuration>
<sourceInventoryDir>${project.build.directory}/inventory-base</sourceInventoryDir>
<sourceInventoryIncludes>**/*.xls</sourceInventoryIncludes>

<inventory>${project.inventory}</inventory>

<targetReportDir>${basedir}/src/main/dita/${project.artifactId}/gen</targetReportDir>

<securityPolicyFile>${project.basedir}/../../security-policy-report.json</securityPolicyFile>

<enableVulnerabilityReport>true</enableVulnerabilityReport>
<enableVulnerabilityStatisticsReport>true</enableVulnerabilityStatisticsReport>

<!--<filterAdvisorySummary>true</filterAdvisorySummary>-->

<failOnError>false</failOnError>
<failOnBanned>false</failOnBanned>
<failOnInternal>false</failOnInternal>
<failOnUnknownVersion>false</failOnUnknownVersion>
<failOnUnknown>false</failOnUnknown>
<failOnUpgrade>false</failOnUpgrade>
<failOnDowngrade>false</failOnDowngrade>
<failOnDevelopment>false</failOnDevelopment>
<failOnMissingLicense>false</failOnMissingLicense>
<failOnMissingLicenseFile>false</failOnMissingLicenseFile>
<failOnMissingNotice>false</failOnMissingNotice>
<failOnMissingSources>false</failOnMissingSources>

<generateOverviewTablesForAdvisories>
[ {"name":"CERT_EU"} ]
</generateOverviewTablesForAdvisories>
</configuration>

</plugin>
</plugins>
</pluginManagement>

<plugins>
<plugin>
<groupId>org.metaeffekt.core</groupId>
<artifactId>ae-inventory-maven-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
Expand Down
26 changes: 26 additions & 0 deletions documents/reports/example-report/src/main/asset-descriptor/asset-descriptor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
inventories:
- "ae-example":
file: "../../../target/inventories/inventory/ae-example-report-summary.xlsx"
type: INPUT

documents:
"ae-example":
type: VULNERABILITY_REPORT
language: "en"
params:
"securityPolicyFile": "security-policy-report.json"
"generateOverviewTablesForAdvisories": "CERT_EU"
parts:
"stat":
type: VULNERABILITY_STATISTICS_REPORT
inventories:
- inventoryRef: "ae-example"
assetName: "AE-Example"
assetVersion: "1.0"
"vul":
type: VULNERABILITY_REPORT
inventories:
- inventoryRef: "ae-example"
assetName: "AE-Example"
assetVersion: "1.0"

2 changes: 1 addition & 1 deletion ...s/example-report/src/main/dita/ae-example-report/tmp/tpc_vulnerability-report-notice.dita
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@

<section>
<title>Insignificant Vulnerabilities Threshold</title>
<p conref="../gen/tpc_inventory-vulnerability-notice.dita#tpc_vulnerability-notice-default/threshold" />
<!-- <p conref="../gen/ae-example/tpc_inventory-vulnerability-notice.dita#tpc_vulnerability-notice-default/threshold" /> -->
</section>

<section>
Expand Down
5 changes: 1 addition & 4 deletions documents/reports/example-report/src/main/dita/bm_report.ditamap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,7 @@

<chapter href="ae-example-report/tpc_vulnerabilities.dita" />

<chapter href="ae-example-report/gen/tpc_inventory-vulnerability-statistics.dita" />
<chapter href="ae-example-report/gen/tpc_inventory-vulnerability-report.dita" />
<chapter href="ae-example-report/gen/tpc_inventory-vulnerability-details.dita" />
<chapter href="ae-example-report/gen/tpc_inventory-cert.dita" />
<chapter format="ditamap" href="ae-example-report/gen/map_ae-example-document.ditamap" />

<backmatter>
<booklists>
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
</scm>

<properties>
<ae.core.version>HEAD-SNAPSHOT</ae.core.version>
<ae.core.version>0.134.0</ae.core.version>
<ae.artifact.analysis.version>HEAD-SNAPSHOT</ae.artifact.analysis.version>
<ae.dita.version>0.29.0</ae.dita.version>

Expand Down