diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index b9d4690db..084fe2a47 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -124,6 +124,24 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. + + org.apache.maven.plugins + maven-invoker-plugin + 2.0.0 + + ${project.build.directory}/it + target/local-repo + + + + integration-test + + install + run + + + + diff --git a/dependency-check-maven/src/it/618-aggregator-purge/invoker.properties b/dependency-check-maven/src/it/618-aggregator-purge/invoker.properties new file mode 100644 index 000000000..b93b3959f --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-purge/invoker.properties @@ -0,0 +1,21 @@ +# +# This file is part of dependency-check-maven. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Copyright (c) 2014 Jeremy Long. All Rights Reserved. +# + +invoker.goals.1 = ${project.groupId}:${project.artifactId}:${project.version}:update-only +invoker.postBuildHookScript.1 = save-nvd-cve.groovy +invoker.goals.2 = ${project.groupId}:${project.artifactId}:${project.version}:purge diff --git a/dependency-check-maven/src/it/618-aggregator-purge/module/pom.xml b/dependency-check-maven/src/it/618-aggregator-purge/module/pom.xml new file mode 100644 index 000000000..21af13b81 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-purge/module/pom.xml @@ -0,0 +1,35 @@ + + + + 4.0.0 + + org.owasp.test + hierarchical + 1.0.0-SNAPSHOT + + module + jar + + + log4j + log4j + 1.2.17 + + + diff --git a/dependency-check-maven/src/it/618-aggregator-purge/pom.xml b/dependency-check-maven/src/it/618-aggregator-purge/pom.xml new file mode 100644 index 000000000..57d3097e6 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-purge/pom.xml @@ -0,0 +1,28 @@ + + + + 4.0.0 + org.owasp.test + hierarchical + 1.0.0-SNAPSHOT + pom + + module + + \ No newline at end of file diff --git a/dependency-check-maven/src/it/618-aggregator-purge/prebuild.groovy b/dependency-check-maven/src/it/618-aggregator-purge/prebuild.groovy new file mode 100644 index 000000000..c1e9eda11 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-purge/prebuild.groovy @@ -0,0 +1,28 @@ +/* + * This file is part of dependency-check-maven. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ + +import org.apache.commons.io.FileUtils; + +// Load NVD-CVE if not exist and had been saved in a previous IT +File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db"); +File datasSave = new File("target/nvd-cve-backup", "dc.h2.db"); + +if (!datasDwl.exists() && datasSave.exists()){ + System.out.println("Load NVD-CVE from backup"); + FileUtils.copyFile(datasSave, datasDwl); +} diff --git a/dependency-check-maven/src/it/618-aggregator-purge/save-nvd-cve.groovy b/dependency-check-maven/src/it/618-aggregator-purge/save-nvd-cve.groovy new file mode 100644 index 000000000..7ed8b07c4 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-purge/save-nvd-cve.groovy @@ -0,0 +1,29 @@ +/* + * This file is part of dependency-check-maven. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ + +import java.nio.charset.Charset; +import org.apache.commons.io.FileUtils; +import org.apache.commons.lang.StringUtils; + +// Save NVD-CVE for next IT (if not already done) +File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db"); +File datasSave = new File("target/nvd-cve-backup", "dc.h2.db"); +if (datasDwl.exists() && !datasSave.exists()){ + System.out.println("Save NVD-CVE into backup"); + FileUtils.copyFile(datasDwl, datasSave); +} diff --git a/dependency-check-maven/src/it/618-aggregator-update-only/invoker.properties b/dependency-check-maven/src/it/618-aggregator-update-only/invoker.properties new file mode 100644 index 000000000..07d487144 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-update-only/invoker.properties @@ -0,0 +1,19 @@ +# +# This file is part of dependency-check-maven. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Copyright (c) 2014 Jeremy Long. All Rights Reserved. +# + +invoker.goals = ${project.groupId}:${project.artifactId}:${project.version}:update-only \ No newline at end of file diff --git a/dependency-check-maven/src/it/618-aggregator-update-only/module/pom.xml b/dependency-check-maven/src/it/618-aggregator-update-only/module/pom.xml new file mode 100644 index 000000000..21af13b81 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-update-only/module/pom.xml @@ -0,0 +1,35 @@ + + + + 4.0.0 + + org.owasp.test + hierarchical + 1.0.0-SNAPSHOT + + module + jar + + + log4j + log4j + 1.2.17 + + + diff --git a/dependency-check-maven/src/it/618-aggregator-update-only/pom.xml b/dependency-check-maven/src/it/618-aggregator-update-only/pom.xml new file mode 100644 index 000000000..57d3097e6 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-update-only/pom.xml @@ -0,0 +1,28 @@ + + + + 4.0.0 + org.owasp.test + hierarchical + 1.0.0-SNAPSHOT + pom + + module + + \ No newline at end of file diff --git a/dependency-check-maven/src/it/618-aggregator-update-only/postbuild.groovy b/dependency-check-maven/src/it/618-aggregator-update-only/postbuild.groovy new file mode 100644 index 000000000..389ddb710 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-update-only/postbuild.groovy @@ -0,0 +1,38 @@ +/* + * This file is part of dependency-check-maven. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ + +import java.nio.charset.Charset; +import org.apache.commons.io.FileUtils; +import org.apache.commons.lang.StringUtils; + +// Save NVD-CVE for next IT (if not already done) +File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db"); +File datasSave = new File("target/nvd-cve-backup", "dc.h2.db"); +if (datasDwl.exists() && !datasSave.exists()){ + System.out.println("Save NVD-CVE into backup"); + FileUtils.copyFile(datasDwl, datasSave); +} + +// Analyse number of "Checking for updates" +String log = FileUtils.readFileToString(new File(basedir, "build.log"), Charset.defaultCharset().name()); +int count = StringUtils.countMatches(log, "Checking for updates"); +if (count > 1){ + System.out.println(String.format("The update should be unique, it is %s", count)); + return false; + //throw new Exception(String.format("The update should be unique, it is %s", count)); +} diff --git a/dependency-check-maven/src/it/618-aggregator-update-only/prebuild.groovy b/dependency-check-maven/src/it/618-aggregator-update-only/prebuild.groovy new file mode 100644 index 000000000..c1e9eda11 --- /dev/null +++ b/dependency-check-maven/src/it/618-aggregator-update-only/prebuild.groovy @@ -0,0 +1,28 @@ +/* + * This file is part of dependency-check-maven. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ + +import org.apache.commons.io.FileUtils; + +// Load NVD-CVE if not exist and had been saved in a previous IT +File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db"); +File datasSave = new File("target/nvd-cve-backup", "dc.h2.db"); + +if (!datasDwl.exists() && datasSave.exists()){ + System.out.println("Load NVD-CVE from backup"); + FileUtils.copyFile(datasSave, datasDwl); +} diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/PurgeMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/PurgeMojo.java index 62c14a0dd..8d9f2104b 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/PurgeMojo.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/PurgeMojo.java @@ -37,14 +37,15 @@ import org.owasp.dependencycheck.utils.Settings; defaultPhase = LifecyclePhase.GENERATE_RESOURCES, threadSafe = false, requiresDependencyResolution = ResolutionScope.NONE, - requiresOnline = true + requiresOnline = true, + aggregator = true ) public class PurgeMojo extends BaseDependencyCheckMojo { /** * Returns false; this mojo cannot generate a report. * - * @return false + * @return false */ @Override public boolean canGenerateReport() { diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/UpdateMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/UpdateMojo.java index 9d546b7d4..ed79b6a99 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/UpdateMojo.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/UpdateMojo.java @@ -38,7 +38,8 @@ import org.owasp.dependencycheck.utils.Settings; defaultPhase = LifecyclePhase.GENERATE_RESOURCES, threadSafe = false, requiresDependencyResolution = ResolutionScope.NONE, - requiresOnline = true + requiresOnline = true, + aggregator = true ) public class UpdateMojo extends BaseDependencyCheckMojo {