WhiteSourceReport library

WhiteSource report library is used to determine the library/packages vulnerabilities by calling the WhiteSource API.

The result generates a pdf file showing the vulnerabilities and also sends the tabled list to the Mattermost verifier-build channel.

Builder

def ws = new WhiteSourceReport.Builder()
             .context(context)
             .userKey(userKey)
             .apiKey(apiKey)
             .build()

• Context- Jenkins context (‘this’ in pipeline context)

• Userkey - WhiteSource Userkey from Jenkins Credentials

• ApiKey - WhiteSource ApiKey from Jenks Credentials

Methods

void generatePdfReport(String config, String projectToken, String project)

This generates the report in pdf format which will be persisted in the build artifacts.

• Config- This is the config of the environment the project is built in e.g Android, Yarn, or Groovy project.

• ProjectToken - The WhiteSource token for the particular project

• Project - The Project name, used to name the pdf generated.

void generateRiskReportAndNotify(String productToken, String peopleToNotify, String project)

This gets the list of all the vulnerabilities of the particular product, and then table and send to the MatterMost verifier-build channel.

• ProductToken - WhiteSource productToken for the specific product.

• PeopleToNotify - A string detailing MatterMost usernames for people to be notified

• Project - The Project name

Example Usage

#!groovy

import com.amarula.build.Build
import com.amarula.ws.WhiteSourceReport

node('android-build') {
    def credentials = 'credentials'
    def build = new Build(this, env, credentials)
    def context = this
    def repoUrl = "${GERRIT_SSH_JENKINSBUILDER_URL}/project"
    def projectToken = 'projectToken'
    def productToken = 'productToken'
    def project = 'SampleProject'
    def ws

    withCredentials([string(credentialsId: 'amarula-whitesource_user_key', variable: 'userKey'), string(credentialsId: 'amarula-whitesource_api_key', variable: 'apiKey')]) {
        ws = new WhiteSourceReport.Builder()
             .context(context)
             .userKey(userKey)
             .apiKey(apiKey)
             .build()
    }

    build.setSyncMethod(Build.CHECKOUT)
    stage('report') {
        build.build(repoUrl, {
            ws.generatePdfReport(androidwssconfig, projectToken, project) //config passed via pipeline parameters
            ws.generateRiskReportAndNotify(productToken, "@john, @doe", project)
        }, ['branch': 'development', 'history': true])

    }
    archiveArtifacts '**/*whitesource.*.log'
    archiveArtifacts '**/*.pdf'
}