[GitHub] [eagle] grainier opened a new pull request #1005: [EAGLE-1102] Integrate CVE maven plugin

[GitBox <gi...@apache.org>]

grainier opened a new pull request #1005: [EAGLE-1102] Integrate CVE maven plugin
URL: https://github.com/apache/eagle/pull/1005
 
 
   <!--
   {% comment %}
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to you under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at
   
   http://www.apache.org/licenses/LICENSE-2.0
   
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
   {% endcomment %}
   -->
   
   ## Purpose
   Purpose of this pull request is to integrate the CVE maven plugin for eagle to check security vulnerabilities in dependencies during build time. This will help to detect publicly disclosed vulnerabilities contained within eagle's dependencies (and the dependencies of all child modules).
   
   ## Usage
   
   This plugin configuration is attached to the `mvn verify` phase. Therefore, this will run automatically when we perform a `mvn clean verify`. Once the `mvn` process is completed, the plugin will create a `dependency-check-report.html` report in `target/` dir with the detect vulnerabilities.
   
   In case if you need to skip this plugin, use `owasp.check.skip=true` property (i.e `mvn clean verify -Dowasp.check.skip=true`). 
   
   ## Remarks
   - Fixes https://issues.apache.org/jira/browse/EAGLE-1102
   - https://issues.apache.org/jira/browse/EAGLE-1100
   - https://github.com/jeremylong/DependencyCheck
   - https://jeremylong.github.io/DependencyCheck/dependency-check-maven/aggregate-mojo.html
   - https://jeremylong.github.io/DependencyCheck/general/suppression.html
   ---
   
   Be sure to do all of the following to help us incorporate your contribution
   quickly and easily:
   
    - [x] Make sure the PR title is formatted like:
      `[EAGLE-<Jira issue #>] Description of pull request`
    - [x] Make sure tests pass via `mvn clean verify`. (Even better, enable
          Travis-CI on your fork and ensure the whole test matrix passes).
    - [x] Replace `<Jira issue #>` in the title with the actual Jira issue
          number, if there is one.
    - [ ] If this contribution is large, please file an Apache
          [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.txt).
   
   ---

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services