mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-03-20 08:14:44 +01:00
Merge branch 'axel3rd-MavenMojosPurgeAndUpdateOnlyAggregator'
This commit is contained in:
Jeremy Long
@@ -575,15 +575,19 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
|||||||
</plugins>
|
</plugins>
|
||||||
</build>
|
</build>
|
||||||
</profile>
|
</profile>
|
||||||
<profile>
|
<!--
|
||||||
<!-- The following profile adds additional
|
The following profile adds additional dependencies that are only
|
||||||
dependencies that are only used during testing.
|
used during testing.
|
||||||
Additionally, these are only added when using "allTests" to
|
|
||||||
make the build slightly faster in most cases. -->
|
TODO move the following FP tests to a seperate invoker test in the
|
||||||
|
maven plugin project. Add checks against the XML to validate that
|
||||||
|
these do not report FP.
|
||||||
|
-->
|
||||||
|
<!--profile>
|
||||||
<id>False Positive Tests</id>
|
<id>False Positive Tests</id>
|
||||||
<activation>
|
<activation>
|
||||||
<property>
|
<property>
|
||||||
<name>allTests</name>
|
<name>releaseTesting</name>
|
||||||
</property>
|
</property>
|
||||||
</activation>
|
</activation>
|
||||||
<dependencies>
|
<dependencies>
|
||||||
@@ -664,13 +668,6 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
|||||||
<scope>test</scope>
|
<scope>test</scope>
|
||||||
<optional>true</optional>
|
<optional>true</optional>
|
||||||
</dependency>
|
</dependency>
|
||||||
<dependency>
|
|
||||||
<groupId>org.springframework</groupId>
|
|
||||||
<artifactId>spring-webmvc</artifactId>
|
|
||||||
<version>3.2.12.RELEASE</version>
|
|
||||||
<scope>test</scope>
|
|
||||||
<optional>true</optional>
|
|
||||||
</dependency>
|
|
||||||
<dependency>
|
<dependency>
|
||||||
<groupId>com.google.code.gson</groupId>
|
<groupId>com.google.code.gson</groupId>
|
||||||
<artifactId>gson</artifactId>
|
<artifactId>gson</artifactId>
|
||||||
@@ -728,6 +725,6 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
|||||||
<optional>true</optional>
|
<optional>true</optional>
|
||||||
</dependency>
|
</dependency>
|
||||||
</dependencies>
|
</dependencies>
|
||||||
</profile>
|
</profile-->
|
||||||
</profiles>
|
</profiles>
|
||||||
</project>
|
</project>
|
||||||
|
|||||||
@@ -116,7 +116,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
|||||||
<configuration>
|
<configuration>
|
||||||
<rules>
|
<rules>
|
||||||
<requireMavenVersion>
|
<requireMavenVersion>
|
||||||
<version>[3.0,]</version>
|
<version>[3.1,]</version>
|
||||||
</requireMavenVersion>
|
</requireMavenVersion>
|
||||||
</rules>
|
</rules>
|
||||||
<fail>true</fail>
|
<fail>true</fail>
|
||||||
@@ -226,4 +226,36 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
|||||||
<scope>test</scope>
|
<scope>test</scope>
|
||||||
</dependency>
|
</dependency>
|
||||||
</dependencies>
|
</dependencies>
|
||||||
|
<profiles>
|
||||||
|
<profile>
|
||||||
|
<id>FullIntegrationTesting</id>
|
||||||
|
<activation>
|
||||||
|
<property>
|
||||||
|
<name>releaseTesting</name>
|
||||||
|
</property>
|
||||||
|
</activation>
|
||||||
|
<build>
|
||||||
|
<plugins>
|
||||||
|
<plugin>
|
||||||
|
<groupId>org.apache.maven.plugins</groupId>
|
||||||
|
<artifactId>maven-invoker-plugin</artifactId>
|
||||||
|
<version>2.0.0</version>
|
||||||
|
<configuration>
|
||||||
|
<cloneProjectsTo>${project.build.directory}/it</cloneProjectsTo>
|
||||||
|
<localRepositoryPath>target/local-repo</localRepositoryPath>
|
||||||
|
</configuration>
|
||||||
|
<executions>
|
||||||
|
<execution>
|
||||||
|
<id>integration-test</id>
|
||||||
|
<goals>
|
||||||
|
<goal>install</goal>
|
||||||
|
<goal>run</goal>
|
||||||
|
</goals>
|
||||||
|
</execution>
|
||||||
|
</executions>
|
||||||
|
</plugin>
|
||||||
|
</plugins>
|
||||||
|
</build>
|
||||||
|
</profile>
|
||||||
|
</profiles>
|
||||||
</project>
|
</project>
|
||||||
|
|||||||
@@ -0,0 +1,21 @@
|
|||||||
|
#
|
||||||
|
# This file is part of dependency-check-maven.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
#
|
||||||
|
# Copyright (c) 2014 Jeremy Long. All Rights Reserved.
|
||||||
|
#
|
||||||
|
|
||||||
|
invoker.goals.1 = ${project.groupId}:${project.artifactId}:${project.version}:update-only
|
||||||
|
invoker.postBuildHookScript.1 = save-nvd-cve.groovy
|
||||||
|
invoker.goals.2 = ${project.groupId}:${project.artifactId}:${project.version}:purge
|
||||||
@@ -0,0 +1,35 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!--
|
||||||
|
This file is part of dependency-check-maven.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
|
Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
||||||
|
-->
|
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||||
|
<modelVersion>4.0.0</modelVersion>
|
||||||
|
<parent>
|
||||||
|
<groupId>org.owasp.test</groupId>
|
||||||
|
<artifactId>hierarchical</artifactId>
|
||||||
|
<version>1.0.0-SNAPSHOT</version>
|
||||||
|
</parent>
|
||||||
|
<artifactId>module</artifactId>
|
||||||
|
<packaging>jar</packaging>
|
||||||
|
<dependencies>
|
||||||
|
<dependency>
|
||||||
|
<groupId>log4j</groupId>
|
||||||
|
<artifactId>log4j</artifactId>
|
||||||
|
<version>1.2.17</version>
|
||||||
|
</dependency>
|
||||||
|
</dependencies>
|
||||||
|
</project>
|
||||||
28
dependency-check-maven/src/it/618-aggregator-purge/pom.xml
Normal file
28
dependency-check-maven/src/it/618-aggregator-purge/pom.xml
Normal file
@@ -0,0 +1,28 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!--
|
||||||
|
This file is part of dependency-check-maven.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
|
Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
||||||
|
-->
|
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||||
|
<modelVersion>4.0.0</modelVersion>
|
||||||
|
<groupId>org.owasp.test</groupId>
|
||||||
|
<artifactId>hierarchical</artifactId>
|
||||||
|
<version>1.0.0-SNAPSHOT</version>
|
||||||
|
<packaging>pom</packaging>
|
||||||
|
<modules>
|
||||||
|
<module>module</module>
|
||||||
|
</modules>
|
||||||
|
</project>
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
/*
|
||||||
|
* This file is part of dependency-check-maven.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*
|
||||||
|
* Copyright (c) 2014 Jeremy Long. All Rights Reserved.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import org.apache.commons.io.FileUtils;
|
||||||
|
|
||||||
|
// Load NVD-CVE if not exist and had been saved in a previous IT
|
||||||
|
File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db");
|
||||||
|
File datasSave = new File("target/nvd-cve-backup", "dc.h2.db");
|
||||||
|
|
||||||
|
if (!datasDwl.exists() && datasSave.exists()){
|
||||||
|
System.out.println("Load NVD-CVE from backup");
|
||||||
|
FileUtils.copyFile(datasSave, datasDwl);
|
||||||
|
}
|
||||||
@@ -0,0 +1,29 @@
|
|||||||
|
/*
|
||||||
|
* This file is part of dependency-check-maven.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*
|
||||||
|
* Copyright (c) 2014 Jeremy Long. All Rights Reserved.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import java.nio.charset.Charset;
|
||||||
|
import org.apache.commons.io.FileUtils;
|
||||||
|
import org.apache.commons.lang.StringUtils;
|
||||||
|
|
||||||
|
// Save NVD-CVE for next IT (if not already done)
|
||||||
|
File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db");
|
||||||
|
File datasSave = new File("target/nvd-cve-backup", "dc.h2.db");
|
||||||
|
if (datasDwl.exists() && !datasSave.exists()){
|
||||||
|
System.out.println("Save NVD-CVE into backup");
|
||||||
|
FileUtils.copyFile(datasDwl, datasSave);
|
||||||
|
}
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
#
|
||||||
|
# This file is part of dependency-check-maven.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
#
|
||||||
|
# Copyright (c) 2014 Jeremy Long. All Rights Reserved.
|
||||||
|
#
|
||||||
|
|
||||||
|
invoker.goals = ${project.groupId}:${project.artifactId}:${project.version}:update-only
|
||||||
@@ -0,0 +1,35 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!--
|
||||||
|
This file is part of dependency-check-maven.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
|
Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
||||||
|
-->
|
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||||
|
<modelVersion>4.0.0</modelVersion>
|
||||||
|
<parent>
|
||||||
|
<groupId>org.owasp.test</groupId>
|
||||||
|
<artifactId>hierarchical</artifactId>
|
||||||
|
<version>1.0.0-SNAPSHOT</version>
|
||||||
|
</parent>
|
||||||
|
<artifactId>module</artifactId>
|
||||||
|
<packaging>jar</packaging>
|
||||||
|
<dependencies>
|
||||||
|
<dependency>
|
||||||
|
<groupId>log4j</groupId>
|
||||||
|
<artifactId>log4j</artifactId>
|
||||||
|
<version>1.2.17</version>
|
||||||
|
</dependency>
|
||||||
|
</dependencies>
|
||||||
|
</project>
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!--
|
||||||
|
This file is part of dependency-check-maven.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
|
Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
||||||
|
-->
|
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||||
|
<modelVersion>4.0.0</modelVersion>
|
||||||
|
<groupId>org.owasp.test</groupId>
|
||||||
|
<artifactId>hierarchical</artifactId>
|
||||||
|
<version>1.0.0-SNAPSHOT</version>
|
||||||
|
<packaging>pom</packaging>
|
||||||
|
<modules>
|
||||||
|
<module>module</module>
|
||||||
|
</modules>
|
||||||
|
</project>
|
||||||
@@ -0,0 +1,38 @@
|
|||||||
|
/*
|
||||||
|
* This file is part of dependency-check-maven.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*
|
||||||
|
* Copyright (c) 2014 Jeremy Long. All Rights Reserved.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import java.nio.charset.Charset;
|
||||||
|
import org.apache.commons.io.FileUtils;
|
||||||
|
import org.apache.commons.lang.StringUtils;
|
||||||
|
|
||||||
|
// Save NVD-CVE for next IT (if not already done)
|
||||||
|
File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db");
|
||||||
|
File datasSave = new File("target/nvd-cve-backup", "dc.h2.db");
|
||||||
|
if (datasDwl.exists() && !datasSave.exists()){
|
||||||
|
System.out.println("Save NVD-CVE into backup");
|
||||||
|
FileUtils.copyFile(datasDwl, datasSave);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Analyse number of "Checking for updates"
|
||||||
|
String log = FileUtils.readFileToString(new File(basedir, "build.log"), Charset.defaultCharset().name());
|
||||||
|
int count = StringUtils.countMatches(log, "Checking for updates");
|
||||||
|
if (count > 1){
|
||||||
|
System.out.println(String.format("The update should be unique, it is %s", count));
|
||||||
|
return false;
|
||||||
|
//throw new Exception(String.format("The update should be unique, it is %s", count));
|
||||||
|
}
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
/*
|
||||||
|
* This file is part of dependency-check-maven.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*
|
||||||
|
* Copyright (c) 2014 Jeremy Long. All Rights Reserved.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import org.apache.commons.io.FileUtils;
|
||||||
|
|
||||||
|
// Load NVD-CVE if not exist and had been saved in a previous IT
|
||||||
|
File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db");
|
||||||
|
File datasSave = new File("target/nvd-cve-backup", "dc.h2.db");
|
||||||
|
|
||||||
|
if (!datasDwl.exists() && datasSave.exists()){
|
||||||
|
System.out.println("Load NVD-CVE from backup");
|
||||||
|
FileUtils.copyFile(datasSave, datasDwl);
|
||||||
|
}
|
||||||
@@ -37,14 +37,15 @@ import org.owasp.dependencycheck.utils.Settings;
|
|||||||
defaultPhase = LifecyclePhase.GENERATE_RESOURCES,
|
defaultPhase = LifecyclePhase.GENERATE_RESOURCES,
|
||||||
threadSafe = false,
|
threadSafe = false,
|
||||||
requiresDependencyResolution = ResolutionScope.NONE,
|
requiresDependencyResolution = ResolutionScope.NONE,
|
||||||
requiresOnline = true
|
requiresOnline = true,
|
||||||
|
aggregator = true
|
||||||
)
|
)
|
||||||
public class PurgeMojo extends BaseDependencyCheckMojo {
|
public class PurgeMojo extends BaseDependencyCheckMojo {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Returns false; this mojo cannot generate a report.
|
* Returns false; this mojo cannot generate a report.
|
||||||
*
|
*
|
||||||
* @return <code>false</code>
|
* @return <code>false</code>
|
||||||
*/
|
*/
|
||||||
@Override
|
@Override
|
||||||
public boolean canGenerateReport() {
|
public boolean canGenerateReport() {
|
||||||
|
|||||||
@@ -38,7 +38,8 @@ import org.owasp.dependencycheck.utils.Settings;
|
|||||||
defaultPhase = LifecyclePhase.GENERATE_RESOURCES,
|
defaultPhase = LifecyclePhase.GENERATE_RESOURCES,
|
||||||
threadSafe = false,
|
threadSafe = false,
|
||||||
requiresDependencyResolution = ResolutionScope.NONE,
|
requiresDependencyResolution = ResolutionScope.NONE,
|
||||||
requiresOnline = true
|
requiresOnline = true,
|
||||||
|
aggregator = true
|
||||||
)
|
)
|
||||||
public class UpdateMojo extends BaseDependencyCheckMojo {
|
public class UpdateMojo extends BaseDependencyCheckMojo {
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user