forked from sonatype/docker-nexus3
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #17 from sonatype/main
[pull] main from sonatype:main
- Loading branch information
Showing
17 changed files
with
421 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,158 @@ | ||
| /* | ||
| * Copyright (c) 2024-present Sonatype, Inc. All rights reserved. | ||
| * "Sonatype" is a trademark of Sonatype, Inc. | ||
| */ | ||
|
|
||
| @Library(['private-pipeline-library', 'jenkins-shared']) _ | ||
|
|
||
| import com.sonatype.jenkins.pipeline.OsTools | ||
| import groovy.json.JsonSlurper | ||
|
|
||
| IQ_URL_BASE = "https://sonatype.sonatype.app/platform" | ||
| REPO_BASE_URL = "https://repo.sonatype.com/service/rest" | ||
| TARGET_REPO_NAME = "sonatype-sboms" | ||
| CYCLONEDX_VERSION = "1.5" | ||
|
|
||
| properties([ | ||
| parameters([ | ||
| string(name: 'BRANCH_TO_BUILD', defaultValue: '', | ||
| description: 'Branch the script will be loaded from'), | ||
| string(name: 'IMAGE_VERSION', defaultValue: '', | ||
| description: 'Version for the Docker image and NXRM. The result SBOMs will be tagged with this version.'), | ||
| string(name: 'UBI_IMAGE_TAG', defaultValue: '', | ||
| description: 'Tag of the UBI image to be scanned. Visit https://catalog.redhat.com/software/containers/ubi8/ubi-minimal/5c359a62bed8bd75a2c3fba8') | ||
| ]) | ||
| ]) | ||
|
|
||
| def getComponentSbom(String buildDir, String componentName, String componentVersion) { | ||
| def componentId = getComponentInfo(componentName).applications[0].id | ||
| withCredentials([usernamePassword(credentialsId: 'jenkins-saas-service-acct', usernameVariable: 'IQ_USER', passwordVariable: 'IQ_PASSWORD')]) { | ||
| def formats = ['spdx', 'cyclonedx'] | ||
| formats.each { format -> | ||
| def urlPath = format == 'spdx' ? "spdx/${componentId}/stages/release?format=json" : "cycloneDx/${CYCLONEDX_VERSION}/${componentId}/stages/release" | ||
| sh "curl -s -L -u \$IQ_USER:\$IQ_PASSWORD -o '${buildDir}/${format}/${componentName}-${componentVersion}-${format}.json' -X GET -H 'Accept: application/json' '${IQ_URL_BASE}/api/v2/${urlPath}'" | ||
| sh "jq . ${buildDir}/${format}/${componentName}-${componentVersion}-${format}.json > ${buildDir}/${format}/${componentName}-${componentVersion}-${format}-formatted.json" | ||
| sh "mv ${buildDir}/${format}/${componentName}-${componentVersion}-${format}-formatted.json ${buildDir}/${format}/${componentName}-${componentVersion}-${format}.json" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| def getComponentInfo(String componentName) { | ||
| def jsonSlurper = new JsonSlurper() | ||
| def response = null | ||
|
|
||
| withCredentials([ | ||
| usernamePassword( | ||
| credentialsId: 'jenkins-saas-service-acct', | ||
| usernameVariable: 'IQ_USER', | ||
| passwordVariable: 'IQ_PASSWORD') | ||
| ]) { | ||
| def rawResponse = sh(returnStdout: true, script: "curl -s -u \$IQ_USER:\$IQ_PASSWORD -X GET '${IQ_URL_BASE}/api/v2/applications?publicId=${componentName}'") | ||
| response = jsonSlurper.parseText(rawResponse) | ||
| } | ||
| return response | ||
| } | ||
|
|
||
| def publishComponent(String buildDir, String componentName, String componentVersion) { | ||
| def publishCommand = """ | ||
| curl -v -u \$NXRM_USER:\$NXRM_PASSWORD -X POST '${REPO_BASE_URL}/v1/components?repository=${TARGET_REPO_NAME}' \ | ||
| -F 'raw.directory=/PrismaCloud/${componentName}/${componentVersion}/' \ | ||
| -F 'raw.asset1=@${buildDir}/${componentName}-${componentVersion}-prisma-cloud-scan-results.json' \ | ||
| -F 'raw.asset1.filename=${componentName}-${componentVersion}-prisma-cloud-scan-results.json' | ||
| """ | ||
| withCredentials([ | ||
| usernamePassword( | ||
| credentialsId: 'sonatype-sbom-deployer', | ||
| usernameVariable: 'NXRM_USER', | ||
| passwordVariable: 'NXRM_PASSWORD') | ||
| ]) { | ||
| sh(publishCommand) | ||
| } | ||
| // Publish the latest version tag | ||
| def latestPublishCommand = """ | ||
| curl -v -u \$NXRM_USER:\$NXRM_PASSWORD -X POST '${REPO_BASE_URL}/v1/components?repository=${TARGET_REPO_NAME}' \ | ||
| -F 'raw.directory=/PrismaCloud/${componentName}/latest/' \ | ||
| -F 'raw.asset1=@${buildDir}/${componentName}-${componentVersion}-prisma-cloud-scan-results.json' \ | ||
| -F 'raw.asset1.filename=${componentName}-latest-prisma-cloud-scan-results.json' | ||
| """ | ||
| sh(latestPublishCommand) | ||
| } | ||
|
|
||
| def scanAndCopyResults(String image, String resultsFileName) { | ||
| prismaCloudScanImage( | ||
| ca: '', | ||
| cert: '', | ||
| dockerAddress: 'unix:///var/run/docker.sock', | ||
| ignoreImageBuildTime: true, | ||
| image: image, | ||
| key: '', | ||
| logLevel: 'debug', | ||
| podmanPath: '', | ||
| project: '', | ||
| resultsFile: "${env.buildDir}/${resultsFileName}" | ||
| ) | ||
| sh "jq . ${env.buildDir}/${resultsFileName} > ${env.buildDir}/${resultsFileName}-formatted.json" | ||
| sh "mv ${env.buildDir}/${resultsFileName}-formatted.json ${env.buildDir}/${resultsFileName}" | ||
| sh "cp ${env.buildDir}/${resultsFileName} ${resultsFileName}" | ||
| sh "ls -la ${env.buildDir}" | ||
| } | ||
|
|
||
| pipeline { | ||
| agent any | ||
| environment { | ||
| buildDir = "./.sbom-build/job-${env.BUILD_NUMBER}" | ||
| } | ||
| stages { | ||
| stage('Checkout') { | ||
| steps { | ||
| git branch: params.BRANCH_TO_BUILD, url: 'https://github.com/sonatype/docker-nexus3.git' | ||
| } | ||
| } | ||
| stage('Build Image') { | ||
| steps { | ||
| script { | ||
| runSafely("docker build -t docker-nexus3:${params.IMAGE_VERSION} .") | ||
| // Tag the latest version | ||
| runSafely("docker tag docker-nexus3:${params.IMAGE_VERSION} docker-nexus3:latest") | ||
| } | ||
| } | ||
| } | ||
| stage('Analyze Images with Prisma Cloud') { | ||
| steps { | ||
| script { | ||
| sh "mkdir -p ${env.buildDir}/spdx && mkdir -p ${env.buildDir}/cyclonedx" | ||
| echo "Analyzing docker-nexus3 image with Prisma Cloud" | ||
| scanAndCopyResults("docker-nexus3:${params.IMAGE_VERSION}", "docker-nexus3-${params.IMAGE_VERSION}-prisma-cloud-scan-results.json") | ||
|
|
||
| def ubiImage = "registry.access.redhat.com/ubi8/ubi-minimal:${params.UBI_IMAGE_TAG}" | ||
| sh "docker pull ${ubiImage}" | ||
| echo "Analyzing UBI image with Prisma Cloud" | ||
| scanAndCopyResults(ubiImage, "ubi-minimal-${params.UBI_IMAGE_TAG}-prisma-cloud-scan-results.json") | ||
| } | ||
| } | ||
| } | ||
| stage('Publish Scan Results') { | ||
| steps { | ||
| script { | ||
| publishComponent(env.buildDir, "docker-nexus3", params.IMAGE_VERSION) | ||
| publishComponent(env.buildDir, "ubi-minimal", params.UBI_IMAGE_TAG) | ||
| } | ||
| } | ||
| } | ||
| } | ||
| post { | ||
| always { | ||
| prismaCloudPublish resultsFilePattern: "${env.buildDir}/docker-nexus3-${params.IMAGE_VERSION}-prisma-cloud-scan-results.json" | ||
| prismaCloudPublish resultsFilePattern: "${env.buildDir}/ubi-minimal-${params.UBI_IMAGE_TAG}-prisma-cloud-scan-results.json" | ||
|
|
||
| prismaCloudPublish resultsFilePattern: "docker-nexus3-${params.IMAGE_VERSION}-prisma-cloud-scan-results.json" | ||
| prismaCloudPublish resultsFilePattern: "ubi-minimal-${params.UBI_IMAGE_TAG}-prisma-cloud-scan-results.json" | ||
| archiveArtifacts artifacts: "docker-nexus3-${params.IMAGE_VERSION}-prisma-cloud-scan-results.json", fingerprint: true | ||
| archiveArtifacts artifacts: "ubi-minimal-${params.UBI_IMAGE_TAG}-prisma-cloud-scan-results.json", fingerprint: true | ||
|
|
||
| script { | ||
| OsTools.runSafe(this, "rm -rf '${env.buildDir}'") | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.