You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2021/06/07 13:04:19 UTC
[GitHub] [pulsar] lhotari opened a new pull request #10855: [Build] Run OWASP Dependency Check as a scheduled build once per day
lhotari opened a new pull request #10855:
URL: https://github.com/apache/pulsar/pull/10855
### Motivation
Monitoring for new library vulnerabilities without having an automated solution is prone to errors.
There's an enhancement request #8815 about "Automated security and update routine before every release". This PR will help address those aspects.
New library vulnerabilities can be detected earlier when there's a scheduled build once per day.
### Modifications
- add suppressions for false positives
- add suppressions for known issues in distribution/server and make the check
fail if new vulnerabilities are introduced
- run reports for distribution/offloaders, distribution/io and
pulsar-sql/presto-distribution to get a complete report of all
vulnerabilities
- upload report files as GitHub Actions artifact
### Additional context
The current master branch contains a few vulnerabilities:
- libthrift-0.12.0.jar (pkg:maven/org.apache.thrift/libthrift@0.12.0, cpe:2.3:a:apache:thrift:0.12.0:*:*:*:*:*:*:*) : CVE-2019-0205, CVE-2019-0210, CVE-2020-13949
- issue #9248
- vertx-core-3.5.4.jar (pkg:maven/io.vertx/vertx-core@3.5.4, cpe:2.3:a:eclipse:vert.x:3.5.4:*:*:*:*:*:*:*) : CVE-2018-12541, CVE-2019-17640
- more details in #10295 . Waiting for vert.x 3.9.8 release.
- zookeeper-3.6.2.jar (pkg:maven/org.apache.zookeeper/zookeeper@3.6.2, cpe:2.3:a:apache:zookeeper:3.6.2:*:*:*:*:*:*:*) : CVE-2021-21409
- fixed by #10852
These are suppressed in `src/owasp-dependency-check-suppressions.xml` file so that it's possible to run OWASP Dependency Check with `-DfailBuildOnAnyVulnerability=true` for failing the build if any new vulnerabilities are detected. This is the way how this PR sets a baseline and llbrary vulnerabilities can be tracked.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on pull request #10855: [Build] Run OWASP Dependency Check as a scheduled build once per day
Posted by GitBox <gi...@apache.org>.
lhotari commented on pull request #10855:
URL: https://github.com/apache/pulsar/pull/10855#issuecomment-855912082
Here's an example of the OWASP Dependency Check html reports that the schedule build will produce: https://github.com/lhotari/pulsar/actions/runs/914726687
Click on "owasp-dependency-check-reports" to download the zipped files (4 separate reports).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on pull request #10855: [Build] Run OWASP Dependency Check as a scheduled build once per day
Posted by GitBox <gi...@apache.org>.
lhotari commented on pull request #10855:
URL: https://github.com/apache/pulsar/pull/10855#issuecomment-856498941
The results of the scheduled OWASP Dependency Check scans can be found here:
https://github.com/apache/pulsar/actions/workflows/ci-owasp-dependency-check.yaml
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on pull request #10855: [Build] Run OWASP Dependency Check as a scheduled build once per day
Posted by GitBox <gi...@apache.org>.
lhotari commented on pull request #10855:
URL: https://github.com/apache/pulsar/pull/10855#issuecomment-856082764
> Looks good. Is there a way to trigger an email notification to the dev@ list when the job fails?
It's possible, but a bit complicated in GitHub Actions to send email. There are multiple ways to implement the sending of email from GitHub Actions. You need an email sending service in all solutions.
The simplest way might be with SendGrid free, adding the API key as a GitHub Actions secret and using a shell script where [curl is used to send email via the SendGrid REST API](https://sendgrid.com/docs/for-developers/sending-email/curl-examples/).
Perhaps that could be done separately once we see how well the scheduled job works?
Notifications go get sent by GitHub when an action fails but I'm not exactly sure how this gets delivered in apache/pulsar.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] merlimat merged pull request #10855: [Build] Run OWASP Dependency Check as a scheduled build once per day
Posted by GitBox <gi...@apache.org>.
merlimat merged pull request #10855:
URL: https://github.com/apache/pulsar/pull/10855
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari edited a comment on pull request #10855: [Build] Run OWASP Dependency Check as a scheduled build once per day
Posted by GitBox <gi...@apache.org>.
lhotari edited a comment on pull request #10855:
URL: https://github.com/apache/pulsar/pull/10855#issuecomment-856082764
> Looks good. Is there a way to trigger an email notification to the dev@ list when the job fails?
It's possible, but a bit complicated in GitHub Actions to send email. There are multiple ways to implement the sending of email from GitHub Actions. You need an email sending service in all solutions.
The simplest way might be with SendGrid free, adding the API key as a GitHub Actions secret and using a shell script where [curl is used to send email via the SendGrid REST API](https://sendgrid.com/docs/for-developers/sending-email/curl-examples/).
Perhaps that could be done separately once we see how well the scheduled job works?
Notifications do get sent by GitHub when an action fails but I'm not exactly sure how this gets delivered in apache/pulsar.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org