Fortify command line usage

c# security command-line configuration fortify
alice7 picture alice7 · Oct 13, 2010 · Viewed 37.9k times · Source

Has anyone used command line to run fortify? I tryin to incorporate fortify run in my CI build and I dont know how to do it.

Answer

Steve L. picture Steve L. · Dec 13, 2013

Since I can't add a comment, I'll have to offer this as an answer. Our company has integrated the scan process into our TFS build environment and it works pretty well.

We use a series of "Invoke Process" build activities to make this happen. The entire security scan sequence is wrapped in a conditional which is exposed as an argument to the build definition. This allows us to enable or disable scans as needed. We also expose a few other things like Fortify Project, Fortify Project Version, and another conditional for uploading the FPR file.

The gist of it is this:

Clean

sourceanalyzer -b "Build ID" -clean

Build

sourceanalyzer -b "Build ID" devenv BuildID.sln /Rebuild Debug /out "C:\SSCLogs\SSCBuild.log"

Scan

sourceanalyzer -b "Build ID" -scan -format fpr -f BuildID.fpr

Upload to SSC

fortifyclient.bat -url SSCServerUrl -authtoken XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX uploadFPR -file BuildID.fpr -project "MyProject" -version "MyProject v1.0.0"

If you'd like a full rundown and/or some screen captures, I'd be happy to provide something for you.

Related questions

JWT authentication for ASP.NET Web API

I'm trying to support JWT bearer token (JSON Web Token) in my web API application and I'm getting lost. I see support for .NET Core and for OWIN applications. I'm currently hosting my application in IIS. How can I achieve …

Read More
Why is JsonRequestBehavior needed?

Why is Json Request Behavior needed? If I want to restrict the HttpGet requests to my action I can decorate the action with the [HttpPost] attribute Example: [HttpPost] public JsonResult Foo() { return Json("Secrets"); } // Instead of: public JsonResult Foo() { return …

Read More
How to hash a password

I'd like to store the hash of a password on the phone, but I'm not sure how to do it. I can only seem to find encryption methods. How should the password be hashed properly?

Read More