Randhir Singh

Introduction Problem Statement The Oracle Cloud Native Core software currently provides six planned releases per year (program increments), and each release will contain a mix of features and fixes.   In each release we typically move 3rd party software to the latest release in order to stay abreast of the latest security patches for our embedded 3rd party software.  This can lead to an  two to three month lag  for the release of critical security vulnerabilities, which isn't acceptable for critical fixes.     And as we typically only address vulnerabilities on the tip of the release under-development, a customer who has not yet moved to the latest release would need to upgrade to pick up a critical security fix. Currently we only scan products that are under development; once released (posted to OSDC or MOS) we do not go back and rescan.   Because 3rd party vulnerabilities may be found after we have released our software,   a ...

  Introduction The fortify-tools container is located within a shared repository in OCIR and requires a JWT to be able to access.  The variable WF_JWT will need to be set to a valid MAT You will want to choose one of three ways to use the Fortify SCA tooling: Integration Description Using the Fortify Tools Standalone to Scan a Project This is for using the tooling without integration in GitLab CI or Jenkins CI. Using the Fortify Tools In GitLab CI to Scan a Project This is for using the tooling against a project that whose code is hosted in GitLab and whose CI engine is GitLab CI. Using the Fortify Tools In Jenkins CI to Scan a Project This is for using the tooling against a project that whose code is hosted in GitLab and whose CI engine is Jenkins CI. Using the Fortify Tools Standalone to Scan a Project Simple Usage Run the Fortify Tools in a container docker run -t --rm -v <path to project source root directory>:/var/fortify/src phx.ocir.io/oraclegbudevcorp/cn-shared/s...