seiso/easy_sast repository overview

⁠Easy SAST

easy_sast is a docker container for use in integration pipelines to submit an application's build artifacts to a static analysis tool. This has been developed in a way to serve as a build pattern for other containers meant to facilitate similar functionality, and natively integrates with Veracode's Static Analysis product.

• Features⁠
• Quickstart⁠
• Usage⁠
• Contributing⁠

easy_sast is available from Docker Hub⁠ by running docker pull seiso/easy_sast

For advanced usage and more information, see the wiki⁠.

⁠Features

This code base was developed in line with the Rugged Manifesto⁠. As such, it is:

• Simple to use: With workflow options and configurations that intuitively understand DevOps.
• Easily configurable: Practical defaults, and numerous configuration options such as a config file, environment variables, and/or CLI arguments.
• Clear and understandable code: Regular use of type hints, keyword arguments, and a normalized code style make understanding the code intent easy.
• Engineered to be robust: Error handling, automated security validation, and pervasive validation.
• 100% tested: 100% code coverage for unit tests on all commits.
• 100% consistently formatted: Linting of Docker, make, YAML, and Python on all commits.

⁠Quickstart

⁠Prerequisites

In order to build and run this project, we recommend you have Docker 18.09 or newer, find, git, GNU make, and Python 3.

⁠Setup

⁠Integration requirements

In order to integrate with Veracode, you will need to:

• Be able to produce a debug build of your application⁠.

• Have a valid account and license to use Veracode's SAST product⁠ APIs outlined below⁠.

• Have an application in Veracode's Analysis Center⁠ that you intend to use.

• Export your Veracode credentials as environment variables:

   export VERACODE_API_KEY_ID=EXAMPLE
   export VERACODE_API_KEY_SECRET=EXAMPLE
  

  Copy

⁠Getting started

1. Build the docker image:

   make build
   

   Copy
2. Run the docker container, passing it your API credentials and mounting the directory containing your build artifacts into /build:

   docker run --env-file <(env | grep ^VERACODE_API_KEY_) -v "/path/to/build":/build seiso/easy_sast:latest
   

   Copy

Additional details and configuration options are outlined in usage⁠ and on the wiki⁠.

⁠Usage

⁠Command-line

usage: main.py [-h] [--config-file CONFIG_FILE] [--version]
               [--debug | --verbose]

optional arguments:
  -h, --help                          show this help message and exit
  --config-file CONFIG_FILE           specify a config file
  --version                           show program's version number and exit
  --debug                             enable debug level logging
  --verbose                           enable info level logging

There are two recommended methods to pass information into easy_sast at runtime:

1. Pass environment variables to docker run using --env-file⁠. For example:

   docker run --env-file <(env | grep VERACODE_API_KEY_) -v "/path/to/build":/build seiso/easy_sast:latest
   

   Copy
2. You may also want to pass an argument to the Python in the container by appending your arguments to docker run. For example:

   docker run -e VERACODE_API_KEY_ID=EXAMPLE -e VERACODE_API_KEY_SECRET=EXAMPLE seiso/easy_sast:latest --debug
   

   Copy

Want to learn about more advanced usage, such as optimizing SAST for pull requests? Check out the wiki⁠.

⁠Supported Veracode APIs

• Upload API⁠
• Results API⁠

Note that at minimum your Veracode user must have permission to access the upload API and its getapplist.do⁠ endpoint.

If you'd like to see support for more Veracode APIs or workflows to interact with those APIs, please open an issue⁠ and let us know!

⁠Contributing

1. Fork the repository⁠
2. Create a feature branch via git checkout -b feature/description
3. Make your changes
4. Commit your changes via git commit -am 'Summarize the changes here'
5. Create a new pull request (how-to⁠)