From 2454b756c1a77085e85176687ec351bdf3f8947f Mon Sep 17 00:00:00 2001 From: Valentin Kovalenko Date: Wed, 29 May 2024 15:40:40 -0600 Subject: [PATCH 1/5] Create and upload `ssdlc_compliance_report.md` JAVA-5435 --- .evergreen/.evg.yml | 66 ++++++++++++++++++----- .evergreen/ssdlc-report.sh | 53 +++++++++++++++++-- template_ssdlc_compliance_report.md | 82 +++++++++++++++++++++++++++++ 3 files changed, 183 insertions(+), 18 deletions(-) create mode 100644 template_ssdlc_compliance_report.md diff --git a/.evergreen/.evg.yml b/.evergreen/.evg.yml index 37b67c6e1e5..759a5d1740a 100644 --- a/.evergreen/.evg.yml +++ b/.evergreen/.evg.yml @@ -142,6 +142,45 @@ functions: content_type: ${content_type|text/plain} display_name: "orchestration.log" + "create and upload SSDLC release assets": + - command: shell.exec + shell: "bash" + params: + working_dir: "src" + env: + PRODUCT_NAME: ${product_name} + PRODUCT_VERSION: ${product_version} + script: .evergreen/ssdlc-report.sh + - command: ec2.assume_role + params: + role_arn: ${UPLOAD_SSDLC_RELEASE_ASSETS_ROLE_ARN} + - command: s3.put + params: + aws_key: ${AWS_ACCESS_KEY_ID} + aws_secret: ${AWS_SECRET_ACCESS_KEY} + aws_session_token: ${AWS_SESSION_TOKEN} + local_file: ./src/build/ssdlc/ssdlc_compliance_report.md + remote_file: ${product_name}/${product_version}/ssdlc_compliance_report.md + bucket: java-driver-release-assets + region: us-west-1 + permissions: private + content_type: text/markdown + display_name: ssdlc_compliance_report.md + - command: s3.put + params: + aws_key: ${AWS_ACCESS_KEY_ID} + aws_secret: ${AWS_SECRET_ACCESS_KEY} + aws_session_token: ${AWS_SESSION_TOKEN} + local_files_include_filter: + - build/ssdlc/static-analysis-reports/*.sarif + local_files_include_filter_prefix: ./src/ + remote_file: ${product_name}/${product_version}/static-analysis-reports/ + bucket: java-driver-release-assets + region: us-west-1 + permissions: private + content_type: application/sarif+json + display_name: + "upload test results": - command: attach.xunit_results params: @@ -825,24 +864,21 @@ functions: params: working_dir: "src" script: | - tag=$(git describe --tags --always --dirty) - - # remove the leading 'r' - version=$(echo -n "$tag" | cut -c 2-) - - cat < trace-expansions.yml - release_version: "$version" - EOT - cat trace-expansions.yml + PRODUCT_VERSION="$(echo -n "$(git describe --tags --always --dirty)" | cut -c 2-)" + cat > ssdlc-expansions.yml <. + + + + + + + + + + + + + + +
Product name${product_name}
Product version${product_version}
Report date, UTC${report_date_utc}
+ +## Release creator + +This information is available in multiple ways: + + + + + + + + + + + + + + +
Evergreen + Go to + + https://evergreen.mongodb.com/waterfall/mongo-java-driver?bv_filter=Publish%20Release, + find the build triggered from Git tag r${product_version}, see who authored it. +
Papertrail, human-readable + Go to + + https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}, + look at the value in the "Submitter" column. +
Papertrail, JSON + Go to + + https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}&format=json + and loot at the value associated with the submitter key. +
+ +## Process document + +Blocked on . + +The MongoDB SSDLC policy is available at +. + +## Third-darty dependency information + +There are no dependencies to report vulnerabilities of. +Our [SBOM](https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/docs/CYCLONEDX/) lite +is . + +## Static analysis findings + +The static analysis findings are all available at +. +All the findings in the aforementioned reports +are either of the MongoDB status "False Positive" or "No Fix Needed", +because code that has any other findings cannot technically get into the product. + + may also be of interest. + +## Signature information + +The product artifacts are signed. +The signatures can be verified by following instructions at +. From a39b0c8a96e35ce3184a35fabf4fbac84634ded2 Mon Sep 17 00:00:00 2001 From: Valentin Kovalenko Date: Fri, 31 May 2024 09:39:36 -0600 Subject: [PATCH 2/5] Replace `ls` with `printf` JAVA-5435 --- .evergreen/ssdlc-report.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.evergreen/ssdlc-report.sh b/.evergreen/ssdlc-report.sh index d24799bc57b..1ba56e56f20 100755 --- a/.evergreen/ssdlc-report.sh +++ b/.evergreen/ssdlc-report.sh @@ -57,4 +57,6 @@ sed "${SED_EDIT_IN_PLACE_OPTION[@]}" \ -e "s/\${product_version}/${PRODUCT_VERSION}/g" \ -e "s/\${report_date_utc}/$(date -u +%Y-%m-%d)/g" \ "${SSDLC_REPORT_PATH}" -ls "${SSDLC_REPORT_PATH}" +printf "%s\n" "${SSDLC_REPORT_PATH}" + +printf "\n" From d883fc03057dc0b9165b84ef4d8ad892dbbe3bfe Mon Sep 17 00:00:00 2001 From: Valentin Kovalenko Date: Fri, 31 May 2024 10:01:49 -0600 Subject: [PATCH 3/5] Do minor changes JAVA-5435 --- .evergreen/ssdlc-report.sh | 10 +++++++--- template_ssdlc_compliance_report.md | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.evergreen/ssdlc-report.sh b/.evergreen/ssdlc-report.sh index 1ba56e56f20..78f02965e6b 100755 --- a/.evergreen/ssdlc-report.sh +++ b/.evergreen/ssdlc-report.sh @@ -1,6 +1,6 @@ -#!/bin/bash +#!/usr/bin/env bash -set -o errexit +set -eu # Supported/used environment variables: # PRODUCT_NAME @@ -30,7 +30,11 @@ mkdir "${SSDLC_STATIC_ANALYSIS_REPORTS_PATH}" printf "\nCreating SpotBugs SARIF reports\n" ./gradlew -version -./gradlew -PssdlcReport.enabled=true --continue -x test -x integrationTest -x spotlessApply check scalaCheck kotlinCheck || true +set +e + # This `gradlew` command is expected to exit with a non-zero exit status, + # because it reports all the findings that we normally explicitly exclude as "No Fix Needed"/"False Positive". + ./gradlew -PssdlcReport.enabled=true --continue -x test -x integrationTest -x spotlessApply check scalaCheck kotlinCheck +set -e printf "\nSpotBugs created the following SARIF reports\n" IFS=$'\n' declare -a SARIF_PATHS=($(find "${RELATIVE_DIR_PATH}/.." -path "*/spotbugs/*.sarif")) diff --git a/template_ssdlc_compliance_report.md b/template_ssdlc_compliance_report.md index a7497422868..434ab819c21 100644 --- a/template_ssdlc_compliance_report.md +++ b/template_ssdlc_compliance_report.md @@ -47,7 +47,7 @@ This information is available in multiple ways: Go to https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}&format=json - and loot at the value associated with the submitter key. + and look at the value associated with the submitter key. From 06ec2e91292d01329f76efca655ac1fb73c10251 Mon Sep 17 00:00:00 2001 From: Valentin Kovalenko Date: Fri, 31 May 2024 14:15:02 -0600 Subject: [PATCH 4/5] Move `template_ssdlc_compliance_report.md` to `.evergreen/` JAVA-5435 --- .evergreen/ssdlc-report.sh | 2 +- .../template_ssdlc_compliance_report.md | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename template_ssdlc_compliance_report.md => .evergreen/template_ssdlc_compliance_report.md (100%) diff --git a/.evergreen/ssdlc-report.sh b/.evergreen/ssdlc-report.sh index 78f02965e6b..b05e510c66b 100755 --- a/.evergreen/ssdlc-report.sh +++ b/.evergreen/ssdlc-report.sh @@ -47,7 +47,7 @@ for SARIF_PATH in "${SARIF_PATHS[@]}"; do done printf "\nCreating SSDLC compliance report\n" -declare -r TEMPLATE_SSDLC_REPORT_PATH="${RELATIVE_DIR_PATH}/../template_ssdlc_compliance_report.md" +declare -r TEMPLATE_SSDLC_REPORT_PATH="${RELATIVE_DIR_PATH}/template_ssdlc_compliance_report.md" declare -r SSDLC_REPORT_PATH="${SSDLC_PATH}/ssdlc_compliance_report.md" cp "${TEMPLATE_SSDLC_REPORT_PATH}" "${SSDLC_REPORT_PATH}" declare -a SED_EDIT_IN_PLACE_OPTION diff --git a/template_ssdlc_compliance_report.md b/.evergreen/template_ssdlc_compliance_report.md similarity index 100% rename from template_ssdlc_compliance_report.md rename to .evergreen/template_ssdlc_compliance_report.md From 98c51138c7bf48d56678ee53ad3d387573960c46 Mon Sep 17 00:00:00 2001 From: Valentin Kovalenko Date: Mon, 3 Jun 2024 08:31:37 -0600 Subject: [PATCH 5/5] Remove Papertrail links JAVA-5435 --- .evergreen/template_ssdlc_compliance_report.md | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/.evergreen/template_ssdlc_compliance_report.md b/.evergreen/template_ssdlc_compliance_report.md index 434ab819c21..998092b65c9 100644 --- a/.evergreen/template_ssdlc_compliance_report.md +++ b/.evergreen/template_ssdlc_compliance_report.md @@ -33,21 +33,9 @@ This information is available in multiple ways: - Papertrail, human-readable + Papertrail - Go to - - https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}, - look at the value in the "Submitter" column. - - - - Papertrail, JSON - - Go to - - https://papertrail.devprod-infra.prod.corp.mongodb.com/product-version?product=${product_name}&version=${product_version}&format=json - and look at the value associated with the submitter key. + Refer to data in Papertrail. There is currently no official way to serve that data.