Pre-Production Scans: Uploads via Jenkins

Add the plugin to your Jenkins

• Open your Jenkins home page

• Click on Manage Jenkins

• Access to Manage Plugins

• On the Available list, look for Send build to Data Theorem

• Then click on Install

Update the plugin

• Open your jenkins home page
• Click on Manage Jenkins
• Access to Manage Plugins
• On the Updates list, look for Send build to Data Theorem
• Then click on Download now and install after restart
  
• Restart jenkins

Add your Upload API key to the Jenkins global configuration

Retrieve your Upload API key using the  Data Theorem portal at https://www.securetheorem.com/sdlc.

The Upload API Key will be in the “API Key” section.

Then, on the home page of your Jenkins instance, click on Credentials in the sidebar, and then navigate to System and click on Add credentials

You will be able to create a Secret text credentials:

• Add your Upload API key to the secret field.

• Add an ID to identify this key. For example: Data_Theorem_ApiKey

• Add a description to explain the purpose of this key. This can be for example: "API Key to authenticate to the Data Theorem Upload API"

Add or update a Jenkins job

Go back to the home page of your Jenkins instance and open the configuration page of the job that is used as the CI/CD pipeline of your iOS or Android application:

From the configuration page you will have to modify multiple sections:

• Build Environment: Unlock the "Binding" section to access the API Key from the credentials

• Build: Add your building steps

• Post-build action : Add your post-builds action including the Data Theorem plugin

Get access to your API Key

Use the Credential Binding Plugin to bind the API Key added in the previous step to an environment variable.

The environment variable must be called: DATA_THEOREM_UPLOAD_API_KEY.

Add your building steps

Build your sources using the Build section. You need to generate a valid .apk/.ipa package during this step.

Add your Data Theorem plugin to the job

The Data Theorem plugin can be added from the Add post-build action list

Configure the plugin by indicating the file name that will be generated on the Build To Upload field.This allows the plugin to retrieve the package and to upload it.

You can use a wildcard character * to indicate variable parts of the build's file name (for example if the app's version number or build date is in the file name). The previously build file names will be automatically found from your archive folder or in the current workspace.

You can simulate what file would be sent without actually uploading it to Data Theorem, by checking Don't Upload Build in the advanced options. Only builds that needed be analyzed by Data Theorem's mobile app security services should be sent.

If needed you can configure the plugin to hit your company proxy on the advanced option of Post-Build Actions.
You will have to specify the hostname and the port of the targeted proxy. You can also add your authentication credentials and bypass the certificate validation if needed

Start a new build to test the plugin

You can test that the plugin is correctly configured by starting a new build and then access the last build result. If the plugin works you should get the following console output: