Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

The following steps allow organizations to automatically scan releases of their source code using existing developer tools and processes. DevOps can fully automate the SDLC by integrating our API to existing CI/CD tools such as Azure DevOps, Travis CI, Jenkins, Bitrise, fastlane, Xcode server, etc.

Note: If your organization is using Github, Bitbucket or Gitlab, we recommend using the fully-integrated Data Theorem SAST plugins, see onboarding steps from the DevSecOps page in the Data Theorem portal:

https://www.securetheorem.com/devsecops/v2/sast-code-analysis

Quickstart guide

Step 1: Retrieving the SAST Scanning API key

First, you will need to retrieve/create an API Key from the Data Theorem portal, at ​https://www.securetheorem.com/devsecops/v2/results_api_access

Make sure that the SAST Scanning permission is enabled for this API Key

Step 2: Configuring an upload step in CI/CD

Most CI/CD systems (Travis CI, Bitrise, CircleCI, etc.) allow running a bash script as a step within the CI pipeline. A new step should be added at the end of your existing pipeline to request a SAST scan from Data Theorem.

This new upload step requires:

  • The API key retrieved in step 1 to be available in the CI system
    via the DT_SAST_SCANNING_API_KEY environment variable.

  • The name of the source code repository to be available in the CI system
    via the DT_SAST_SCANNING_REPOSITORY_NAME environment variable.

The following bash script can then be used as the upload step:

#!/bin/env bash
# Fail if any commands fails
set -e

if [ -z "$DT_SAST_SCANNING_API_KEY" ]; then
  echo "DT_SAST_SCANNING_API_KEY is not set!"
  exit 1
fi

if [ -z "$DT_SAST_SCANNING_REPOSITORY_NAME" ]; then
  echo "DT_SAST_SCANNING_REPOSITORY_NAME is not set!"
  exit 1
fi

file_name="${DT_SAST_SCANNING_REPOSITORY_NAME}.bundle"

echo "Preparing for upload"
git bundle create $file_name HEAD --all
file_size=$(stat -c%s $file_name)

echo "Requesting upload URL from Data Theorem"
upload_init_response=$(curl -s -w "%{http_code}" -X POST -H "Authorization: APIKey ${DT_SAST_SCANNING_API_KEY}" -H "Content-Type: application/json" -d "{\"file_name\": \"$file_name\", \"file_size\": $file_size}" "https://api.securetheorem.com/apis/devops/v1/asset_scans/sast_scans")
http_code=${upload_init_response: -3}
response_body=${upload_init_response::-3}

# Check that http status code is 200
[ ! ${http_code} -eq 200 ] && echo ${response_body} && exit 1
upload_url=$(echo ${response_body} | jq -r ".upload_url")
if [ -z "$upload_url" ]; then
    exit 1
fi

echo "Starting upload"
upload=$(curl -X PUT --data-binary "@$file_name" $upload_url)
if [ $? -ne 0 ]; then
    echo "Upload Failed!"
    exit 1
fi

echo "Done"

Scanning is done in the background and should take a few minutes to complete.
Log into the Data Theorem Portal at ​https://www.securetheorem.com/api/v2/security/sast to view the scan results.

  • No labels