Adding the Fortify Maven plugin is as simple as adding the following lines to your POM file. This is again optional, and in many cases if you specify the full path, you don't even have to add the following lines to all your POM.
If you don't have the source for the Plugin and you want to find out what are the configuration options which can be specified for the plugin, use the mvn help:describe command. If you want to see the options for the maven-sca-plugin shown above, use the following command:
mvn help:describe -DgroupId=com.fortify.ps.maven.plugin -DartifactId=maven-sca-plugin -Dversion=3.50 -Ddetail=true -Doutput=mvn-help.txt
The text file would have all the detailed information available to use with the goals.
To get help information for a specifc MOJO or a Maven goal use the following command:
mvn help:describe -DgroupId=com.fortify.ps.maven.plugin -DartifactId=maven-sca-plugin -Dversion=3.50 -Ddetail=true -Dgoal=scan -Doutput=mvn-help-scan.txt
Posts
You basically told nothing about the plugin or it's usage. The command given is generic and has nothing to do with this plugin specifically.
ReplyDeleteI know. The idea was to show what options are available. :)
ReplyDeleteCan you please describe on how the plugin is used to generate the fpr report?
ReplyDeleteDoes this work with the release plugin? Need to run scan prior to the pom changing to SNAPSHOT.
ReplyDeleteI've got a large code base (more that 60 projects linked together) and I want to generate a unique FPR report for all the suite (Xmx Java Heap 1300M on 32bits host -corporate PC-).
ReplyDeleteWhat would you recommended to useMAVEN on these 60 projects ?
a) call 60 times the goal translate (with default value 'scanEnabled=true)
b) call 60 times the goal with the option 'scanEnabled=false' and the call 1 final time the goal scan separately ?
Thank you
Specify the fortify.sca.toplevel.artifactId=${JOB_NAME} and you should be able to translate and scan in one command and generate a consolidated FPR.
ReplyDeletecan i add parameters to exclude some source files to be scanned? thanks.
ReplyDeleteYes, you can exclude files.
DeleteHow to do this?
Deletedoes fortify support multiple development langs in one project, suppose we have java source and c files in one project, thanks!
ReplyDeleteNo, just one.
DeleteHi,
ReplyDeleteCurrently i am unable to download the maven-sca-plugin of given version above. Can you provide me the alternative version to download this plugin.
Here is the command i am using.
mvn help:describe -DgroupId=com.fortify.ps.maven.plugin -DartifactId=maven-sca-plugin -Dversion=3.50 -Ddetail=true -Doutput=mvn-help.txt
Thanks in Advance,
Samba.
Hi,
ReplyDeleteI am currently unable to download the maven-sca-plugin which was mention above. Can you please provide the alternative to download the plugin.
I am using the below command :
mvn help:describe -DgroupId=com.fortify.ps.maven.plugin -DartifactId=maven-sca-plugin -Dversion=2.6 -Ddetail=true -Doutput=mvn-help.txt
Thanks and Regards,
Samba.
When I run the command mvn sca:scan,
ReplyDeleteI get the below :
No plugin found for prefix 'sca' in the current project and in the plugin groups [com.fortify.ps.maven.plugin, org.jenkins-ci.plugins, org.apache.maven.plugins, org.codehaus.mojo] available from the repositories