Skip to content

Commit e47365f

Browse files
Merge pull request #119 from Contrast-Security-OSS/JAVA-8427-migrate-maven-plugin
JAVA-8427 migrate maven plugin to sdk repo
2 parents d94c7bc + 6ca8f87 commit e47365f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+4971
-74
lines changed
+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: build
2+
3+
on: [push]
4+
5+
jobs:
6+
changelog:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: dangoslen/changelog-enforcer@v3
10+
build:
11+
name: Verify
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
16+
- uses: actions/setup-java@v4
17+
with:
18+
java-version: 11
19+
distribution: temurin
20+
21+
- uses: actions/setup-java@v4
22+
with:
23+
java-version: 17
24+
distribution: temurin
25+
26+
- uses: actions/setup-java@v4
27+
with:
28+
java-version: 21
29+
distribution: temurin
30+
31+
- name: Maven Verify
32+
env:
33+
CONTRAST__API__URL: ${{ secrets.CONTRAST__API__URL }}
34+
CONTRAST__API__USER_NAME: ${{ secrets.CONTRAST__API__USER_NAME }}
35+
CONTRAST__API__API_KEY: ${{ secrets.CONTRAST__API__API_KEY }}
36+
CONTRAST__API__SERVICE_KEY: ${{ secrets.CONTRAST__API__SERVICE_KEY }}
37+
CONTRAST__API__ORGANIZATION_ID: ${{ secrets.CONTRAST__API__ORGANIZATION_ID }}
38+
run: cd maven-plugin/ && ./mvnw --batch-mode -Pend-to-end-test verify

.github/workflows/build-sdk.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
- name: Cache Maven Wrapper
2626
uses: actions/cache@v2
2727
with:
28-
path: ./.mvn/wrapper/maven-wrapper.jar
28+
path: cd sdk/ ./.mvn/wrapper/maven-wrapper.jar
2929
key: ${{ runner.os }}-maven-wrapper-${{ hashFiles('./.mvn/wrapper/maven-wrapper.properties') }}
3030
restore-keys: ${{ runner.os }}-maven-wrapper
3131

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: publish
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
publish:
8+
permissions:
9+
contents: write
10+
environment: Maven Central
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v2
14+
15+
- name: Set up JDK 11
16+
uses: actions/setup-java@v2
17+
with:
18+
java-version: 11
19+
distribution: temurin
20+
server-id: ossrh
21+
server-username: OSSRH_USERNAME
22+
server-password: OSSRH_PASSWORD
23+
gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
24+
gpg-passphrase: GPG_PASSPHRASE
25+
26+
- name: Cache Maven Wrapper
27+
uses: actions/cache@v2
28+
with:
29+
path: cd maven-plugin/ && ./.mvn/wrapper/maven-wrapper.jar
30+
key: ${{ runner.os }}-maven-wrapper-${{ hashFiles('./.mvn/wrapper/maven-wrapper.properties') }}
31+
restore-keys: ${{ runner.os }}-maven-wrapper
32+
33+
- name: Cache Maven Repository
34+
uses: actions/cache@v2
35+
with:
36+
path: ~/.m2/repository
37+
key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
38+
restore-keys: ${{ runner.os }}-m2-repository
39+
40+
# See https://github.com/actions/checkout/issues/13
41+
- name: Configure Git User
42+
run: |
43+
git config --global user.name 'github-actions[bot]'
44+
git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
45+
46+
- name: Maven Release (dry-run)
47+
env:
48+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
49+
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
50+
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
51+
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
52+
run: |
53+
cd maven-plugin/ && ./mvnw -DdryRun=true --batch-mode release:prepare release:perform -Dusername=$GITHUB_ACTOR -Dpassword=$GITHUB_TOKEN
54+
55+
- name: Maven Release
56+
env:
57+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
59+
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
60+
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
61+
run: |
62+
cd maven-plugin/ && ./mvnw --batch-mode release:prepare release:perform -Dusername=$GITHUB_ACTOR -Dpassword=$GITHUB_TOKEN
File renamed without changes.

.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# Project
2-
/.idea
2+
*.private.env.json
3+
*.idea
34
*.iml
45

56
# Maven

README.md

+5-72
Original file line numberDiff line numberDiff line change
@@ -1,80 +1,13 @@
1-
# Contrast Java SDK
1+
# Contrast SDK Repo
22

3-
[![javadoc](https://javadoc.io/badge2/com.contrastsecurity/contrast-sdk-java/javadoc.svg)](https://javadoc.io/doc/com.contrastsecurity/contrast-sdk-java)
4-
[![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.contrastsecurity/contrast-sdk-java/badge.svg)](https://maven-badges.herokuapp.com/maven-central/com.contrastsecurity/contrast-sdk-java)
3+
Root repository for the Contrast SDK, Contrast Gradle Plugin, and Contrast Maven Plugin
54

5+
Each sub-project is a standalone build, with their own maven/gradle builds.
66

7-
This SDK gives you a quick start for programmatically accessing the [Contrast REST API](https://api.contrastsecurity.com/) using Java.
87

8+
[SDK](sdk/README.md)
99

10-
## Requirements
10+
[Maven Plugin](maven-plugin/README.md)
1111

12-
* JDK 1.8
13-
* Contrast Account
1412

1513

16-
## How to use this SDK
17-
18-
1. Add the
19-
[contrast-sdk-java](https://search.maven.org/artifact/com.contrastsecurity/contrast-sdk-java)
20-
dependency from Maven Central to your project.
21-
1. At a minimum, you will need to supply four basic connection parameters ([find them here](https://docs.contrastsecurity.com/en/personal-keys.html)):
22-
* Username
23-
* API Key
24-
* Service Key
25-
* Contrast REST API URL (e.g. https://app.contrastsecurity.com/Contrast/api)
26-
27-
28-
## Example
29-
30-
```java
31-
ContrastSDK contrastSDK = new ContrastSDK.Builder("contrast_admin", "demo", "demo")
32-
.withApiUrl("http://localhost:19080/Contrast/api")
33-
.build();
34-
35-
String orgUuid = contrastSDK.getProfileDefaultOrganizations().getOrganization().getOrgUuid();
36-
37-
Applications apps = contrastSDK.getApplications(orgUuid);
38-
for (Application app : apps.getApplications()) {
39-
System.out.println(app.getName() + " (" + app.getCodeShorthand() + " LOC)");
40-
}
41-
```
42-
43-
Sample output:
44-
```
45-
Aneritx (48K LOC)
46-
Default Web Site (0k LOC)
47-
EnterpriseTPS (48K LOC)
48-
Feynmann (48K LOC)
49-
jhipster-sample (0k LOC)
50-
JSPWiki (48K LOC)
51-
Liferay (48K LOC)
52-
OpenMRS (65K LOC)
53-
OracleFS (48K LOC)
54-
Security Test (< 1K LOC)
55-
Ticketbook (2K LOC)
56-
WebGoat (48K LOC)
57-
WebGoat7 (106K LOC)
58-
```
59-
60-
61-
## Building
62-
63-
Requires JDK 11 to build
64-
65-
Use `./mvnw verify` to build and test changes to the project
66-
67-
68-
### Formatting
69-
70-
To avoid distracting white space changes in pull requests and wasteful bickering
71-
about format preferences, Contrast uses the google-java-format opinionated Java
72-
code formatter to automatically format all code to a common specification.
73-
74-
Developers are expected to configure their editors to automatically apply this
75-
format (plugins exist for both IDEA and Eclipse). Alternatively, developers can
76-
apply the formatting before committing changes using the Maven plugin:
77-
78-
```shell
79-
./mvnw spotless:apply
80-
```
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
/*
2+
* Copyright 2007-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
import java.net.*;
17+
import java.io.*;
18+
import java.nio.channels.*;
19+
import java.util.Properties;
20+
21+
public class MavenWrapperDownloader {
22+
23+
private static final String WRAPPER_VERSION = "0.5.6";
24+
/**
25+
* Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided.
26+
*/
27+
private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/"
28+
+ WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar";
29+
30+
/**
31+
* Path to the maven-wrapper.properties file, which might contain a downloadUrl property to
32+
* use instead of the default one.
33+
*/
34+
private static final String MAVEN_WRAPPER_PROPERTIES_PATH =
35+
".mvn/wrapper/maven-wrapper.properties";
36+
37+
/**
38+
* Path where the maven-wrapper.jar will be saved to.
39+
*/
40+
private static final String MAVEN_WRAPPER_JAR_PATH =
41+
".mvn/wrapper/maven-wrapper.jar";
42+
43+
/**
44+
* Name of the property which should be used to override the default download url for the wrapper.
45+
*/
46+
private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl";
47+
48+
public static void main(String args[]) {
49+
System.out.println("- Downloader started");
50+
File baseDirectory = new File(args[0]);
51+
System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath());
52+
53+
// If the maven-wrapper.properties exists, read it and check if it contains a custom
54+
// wrapperUrl parameter.
55+
File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH);
56+
String url = DEFAULT_DOWNLOAD_URL;
57+
if(mavenWrapperPropertyFile.exists()) {
58+
FileInputStream mavenWrapperPropertyFileInputStream = null;
59+
try {
60+
mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile);
61+
Properties mavenWrapperProperties = new Properties();
62+
mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream);
63+
url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url);
64+
} catch (IOException e) {
65+
System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'");
66+
} finally {
67+
try {
68+
if(mavenWrapperPropertyFileInputStream != null) {
69+
mavenWrapperPropertyFileInputStream.close();
70+
}
71+
} catch (IOException e) {
72+
// Ignore ...
73+
}
74+
}
75+
}
76+
System.out.println("- Downloading from: " + url);
77+
78+
File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH);
79+
if(!outputFile.getParentFile().exists()) {
80+
if(!outputFile.getParentFile().mkdirs()) {
81+
System.out.println(
82+
"- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'");
83+
}
84+
}
85+
System.out.println("- Downloading to: " + outputFile.getAbsolutePath());
86+
try {
87+
downloadFileFromURL(url, outputFile);
88+
System.out.println("Done");
89+
System.exit(0);
90+
} catch (Throwable e) {
91+
System.out.println("- Error downloading");
92+
e.printStackTrace();
93+
System.exit(1);
94+
}
95+
}
96+
97+
private static void downloadFileFromURL(String urlString, File destination) throws Exception {
98+
if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) {
99+
String username = System.getenv("MVNW_USERNAME");
100+
char[] password = System.getenv("MVNW_PASSWORD").toCharArray();
101+
Authenticator.setDefault(new Authenticator() {
102+
@Override
103+
protected PasswordAuthentication getPasswordAuthentication() {
104+
return new PasswordAuthentication(username, password);
105+
}
106+
});
107+
}
108+
URL website = new URL(urlString);
109+
ReadableByteChannel rbc;
110+
rbc = Channels.newChannel(website.openStream());
111+
FileOutputStream fos = new FileOutputStream(destination);
112+
fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
113+
fos.close();
114+
rbc.close();
115+
}
116+
117+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.5/apache-maven-3.8.5-bin.zip
18+
wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar

maven-plugin/CHANGELOG.md

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Changelog
2+
All notable changes to this project will be documented in this file.
3+
4+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
5+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
6+
7+
## [2.13.2] - 2022-01-24
8+
### Changed
9+
- `install` and `verify` goals no longer require the `serverName` configuration parameter. The `serverName` configuration parameter can add stability to the `verify` goal for very active builds, but it is not strictly necessary nor desirable for most use cases.
10+
11+
## [2.13.1] - 2021-08-31
12+
### Added
13+
- Contrast Scan support
14+
15+
### Removed
16+
- `profile` configuration which the Contrast server has not supported since before 3.7.7.
17+
- support for JRE 1.7. Requires minimum JRE 1.8
18+
19+
20+
## [2.12] - 2021-03-09
21+
### Changed
22+
- Tested with JDK 1.8, 11, and 15
23+
- Targets JRE 1.7
24+
- Maven version > 3.6.1 (Released April 2019) is required to build the plugin
25+
26+
27+
## [2.0] - 2018-05-15
28+
### Added
29+
- Vulnerabilities now reconciled using an app version instead of a timestamp
30+
- App version can be generated using `$TRAVIS_BUILD_NUMBER` or `$CIRCLE_BUILD_NUM`
31+
- Source packaging changed to `com.contrastsecurity.maven.plugin`

maven-plugin/LICENSE

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Copyright 2021 Contrast Security, Inc.
2+
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS,
11+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
See the License for the specific language governing permissions and
13+
limitations under the License.
14+

0 commit comments

Comments
 (0)