From 7b1906384ed4bc258dcc5aa3a52bf0a36744d656 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Mon, 2 Sep 2013 12:42:44 -0400 Subject: [PATCH] updated site information Former-commit-id: acb1ea4ba2e719b198465eb5b3dba1dd7bd38509 --- dependency-check-ant/README.md | 46 +++++-------------- dependency-check-cli/README.md | 36 ++++----------- .../src/site/markdown/index.md | 2 +- dependency-check-jenkins/README.md | 27 ++++++----- dependency-check-jenkins/pom.xml | 15 ++---- dependency-check-jenkins/src/site/site.xml | 30 ++++++++++++ pom.xml | 2 +- src/site/markdown/index.md | 2 +- src/site/site.xml | 9 ++-- 9 files changed, 75 insertions(+), 94 deletions(-) create mode 100644 dependency-check-jenkins/src/site/site.xml diff --git a/dependency-check-ant/README.md b/dependency-check-ant/README.md index 2021cfcbd..4cae03c73 100644 --- a/dependency-check-ant/README.md +++ b/dependency-check-ant/README.md @@ -1,47 +1,23 @@ -Dependency-Check +Dependency-Check Ant Task ========= -Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. - -More information can be found on the [wiki]. - -Notice -- - -A very big release of new functionality and plugins will be made available during the BlackHat Arsenal on July 31st, 2013. If you are at BlackHat stop by and see the demos! - -Usage -- - -> $ mvn package - -> $ cd target - -> $ java -jar dependency-check-[version].jar -h - -> $ java -jar dependency-check-[version].jar -a Testing -out . -scan ./test-classes -scan ./lib - -Then load the resulting 'DependencyCheck-Report.html' into your favorite browser. +Dependency-Check Ant Task can be used to check the project dependencies for published security vulnerabilities. The checks +performed are a "best effort" and as such, there could be false positives as well as false negatives. However, +vulnerabilities in 3rd party components is a well-known problem and is currently documented in the 2013 OWASP +Top 10 as [A9 - Using Components with Known Vulnerabilities](https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities). Mailing List -- +------------ -Subscribe: [dependency-check+subscribe@googlegroups.com] [subscribe] +Subscribe: [dependency-check+subscribe@googlegroups.com](mailto:dependency-check+subscribe@googlegroups.com) -Post: [dependency-check@googlegroups.com] [post] +Post: [dependency-check@googlegroups.com](mailto:dependency-check@googlegroups.com) Copyright & License -- +------------------- Dependency-Check is Copyright (c) 2012-2013 Jeremy Long. All Rights Reserved. -Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt] [GPLv3] file for the full license. +Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-ant/blob/master/LICENSE.txt) file for the full license. -Dependency-Check makes use of several other open source libraries. Please see the [NOTICE.txt] [notices] file for more information. - - - [wiki]: https://github.com/jeremylong/DependencyCheck/wiki - [subscribe]: mailto:dependency-check+subscribe@googlegroups.com - [post]: mailto:dependency-check@googlegroups.com - [GPLv3]: https://github.com/jeremylong/DependencyCheck/blob/master/LICENSE.txt - [notices]: https://github.com/jeremylong/DependencyCheck/blob/master/NOTICES.txt \ No newline at end of file +Dependency-Check-Ant makes use of other open source libraries. Please see the [NOTICE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-ant/blob/master/NOTICES.txt) file for more information. diff --git a/dependency-check-cli/README.md b/dependency-check-cli/README.md index 2df244ef6..9b6d12969 100644 --- a/dependency-check-cli/README.md +++ b/dependency-check-cli/README.md @@ -1,41 +1,23 @@ -Dependency-Check +Dependency-Check Command Line ================ -Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. - -More information can be found on the [wiki]. - -Usage ------------- - -``` -$ mvn package -$ cd target/release/bin -$ dependency-check-[version].sh -h -$ dependency-check-[version].sh -a Testing -scan ../../test-classes -``` - -Then load the resulting 'DependencyCheck-Report.html' into your favorite browser. +Dependency-Check Command Line can be used to check project dependencies for published security vulnerabilities. The checks +performed are a "best effort" and as such, there could be false positives as well as false negatives. However, +vulnerabilities in 3rd party components is a well-known problem and is currently documented in the 2013 OWASP +Top 10 as [A9 - Using Components with Known Vulnerabilities](https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities). Mailing List ------------ -Subscribe: [dependency-check+subscribe@googlegroups.com] [subscribe] +Subscribe: [dependency-check+subscribe@googlegroups.com](mailto:dependency-check+subscribe@googlegroups.com) -Post: [dependency-check@googlegroups.com] [post] +Post: [dependency-check@googlegroups.com](mailto:dependency-check@googlegroups.com) Copyright & License ------------ Dependency-Check is Copyright (c) 2012-2013 Jeremy Long. All Rights Reserved. -Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt] [GPLv3] file for the full license. +Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-cli/blob/master/LICENSE.txt) file for the full license. -Dependency-Check makes use of several other open source libraries. Please see the [NOTICE.txt] [notices] file for more information. - - - [wiki]: https://github.com/jeremylong/DependencyCheck/wiki - [subscribe]: mailto:dependency-check+subscribe@googlegroups.com - [post]: mailto:dependency-check@googlegroups.com - [GPLv3]: https://github.com/jeremylong/DependencyCheck/blob/master/LICENSE.txt - [notices]: https://github.com/jeremylong/DependencyCheck/blob/master/NOTICES.txt \ No newline at end of file +Dependency-Check Command Line makes use of other open source libraries. Please see the [NOTICE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-cli/blob/master/NOTICES.txt) file for more information. diff --git a/dependency-check-core/src/site/markdown/index.md b/dependency-check-core/src/site/markdown/index.md index c2a1ddfc4..747bfd87c 100644 --- a/dependency-check-core/src/site/markdown/index.md +++ b/dependency-check-core/src/site/markdown/index.md @@ -13,4 +13,4 @@ The engine is currently exposed via: - [Command Line Tool](../dependency-check-cli/installation.html) - [Maven Plugin](../dependency-check-maven/usage.html) - [Ant Task](../dependency-check-ant/installation.html) -- Jenkins Plugin +- [Jenkins Plugin](../dependency-check-jenkins/index.html) diff --git a/dependency-check-jenkins/README.md b/dependency-check-jenkins/README.md index 0ef0d78f4..05451102b 100644 --- a/dependency-check-jenkins/README.md +++ b/dependency-check-jenkins/README.md @@ -1,34 +1,33 @@ Dependency-Check Jenkins Plugin ============================== -Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. +The Dependency-Check Jenkins Plugin features the ability to perform a dependency +analysis build and later view results post build. The plugin is built using [analysis-core] +and features many of the same features that Jenkins static analysis plugins offer, +including thresholds, charts and the ability to view vulnerability information should +a dependency have one identified. -The Dependency-Check Jenkins Plugin features the ability to perform a dependency analysis build and later view results post build. The plugin is built using [analysis-core] and features many of the same features that Jenkins static analysis plugins offer, including thresholds, charts and the ability to view vulnerability information should a dependency have one identified. +The main repository is located at [jenkins-cli/dependency-check-jenkins](https://github.com/jenkinsci/dependency-check-jenkins). + +The main site for documentation is located at [OWASP Dependency-Check-Jenkins](https://wiki.jenkins-ci.org/display/JENKINS/OWASP+Dependency-Check+Plugin). More information can be found on the [wiki]. Mailing List ------------ -Subscribe: [dependency-check+subscribe@googlegroups.com] [subscribe] +Subscribe: [dependency-check+subscribe@googlegroups.com](mailto:dependency-check+subscribe@googlegroups.com) -Post: [dependency-check@googlegroups.com] [post] +Post: [dependency-check@googlegroups.com](mailto:dependency-check@googlegroups.com) Copyright & License ------------------- -Dependency-Check is Copyright (c) 2012-2013 Jeremy Long. All Rights Reserved. - Dependency-Check Jenkins Plugin is Copyright (c) 2013 Steve Springett. All Rights Reserved. Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt] [GPLv3] file for the full license. -Dependency-Check makes use of several other open source libraries. Please see the [NOTICE.txt] [notices] file for more information. - - - [wiki]: https://github.com/jeremylong/dependency-check-jenkins/wiki + [wiki]: https://github.com/jenkinsci/dependency-check-jenkins/wiki [analysis-core]: http://wiki.jenkins-ci.org/x/CwDgAQ - [subscribe]: mailto:dependency-check+subscribe@googlegroups.com - [post]: mailto:dependency-check@googlegroups.com - [GPLv3]: https://github.com/jeremylong/dependency-check-jenkins/blob/master/LICENSE.txt - [notices]: https://github.com/jeremylong/dependency-check-jenkins/blob/master/NOTICES.txt + [GPLv3]: https://github.com/jenkinsci/dependency-check-jenkins/blob/master/LICENSE.txt + [notices]: https://github.com/jenkinsci/dependency-check-jenkins/blob/master/NOTICES.txt diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml index 40fefb412..f3bc3d4c0 100644 --- a/dependency-check-jenkins/pom.xml +++ b/dependency-check-jenkins/pom.xml @@ -10,8 +10,8 @@ org.owasp - dependency-check-jenkins - Dependency-Check Jenkins Plugin + dependency-check-jenkins + Dependency-Check Jenkins Plugin jar 2012 @@ -33,22 +33,13 @@ scm:git:git@github.com:jenkinsci/dependency-check-jenkins.git - https://github.com/jenkinsci/dependency-check-jenkins.git + https://github.com/jenkinsci/dependency-check-jenkins scm:git:git@github.com:jenkinsci/dependency-check-jenkins.git github https://github.com/jenkinsci/dependency-check-jenkins/issues - - - Dependency Check - dependency-check+subscribe@googlegroups.com - dependency-check+unsubscribe@googlegroups.com - dependency-check@googlegroups.com - https://groups.google.com/forum/?fromgroups#!forum/dependency-check - - GNU General Public License version 3 diff --git a/dependency-check-jenkins/src/site/site.xml b/dependency-check-jenkins/src/site/site.xml new file mode 100644 index 000000000..f96a5ae97 --- /dev/null +++ b/dependency-check-jenkins/src/site/site.xml @@ -0,0 +1,30 @@ + + + + + dependency-check-jenkins + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 703d8d879..5dbaac655 100644 --- a/pom.xml +++ b/pom.xml @@ -78,7 +78,7 @@ along with Dependency-Check. If not, see . scm:git:git@github.com:jeremylong/DependencyCheck.git - https://github.com/jeremylong/DependencyCheck.git + https://github.com/jeremylong/DependencyCheck scm:git:git@github.com:jeremylong/DependencyCheck.git dependency-check-1.0.1 diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md index acd272fb5..f00c39659 100644 --- a/src/site/markdown/index.md +++ b/src/site/markdown/index.md @@ -28,4 +28,4 @@ Dependency-check's core analysis library is exposed in various forms: - [Command Line Tool](dependency-check-cli/index.html) - [Maven Plugin](dependency-check-maven/usage.html) - [Ant Task](dependency-check-ant/installation.html) -- Jenkins Plugin +- [Jenkins Plugin](dependency-check-jenkins/index.html) diff --git a/src/site/site.xml b/src/site/site.xml index 41fdb930d..3dca91576 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -61,15 +61,18 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. The core dependency-check library - + The command line interface for dependency-check. - + An Ant task to run dependency-check. - + A Maven plugin for dependency-check. + + A Jenkins plugin for dependency-check. +