2
votes

We are planning to implement CI/CD with Azure DevOps Services. One of the key thing in the requirement was to integrate Fortify On Demand in the Build Pipeline.

I tried adding the Fortify On Demand SCA tasks to the build pipeline and it just requires few preliminary fields to fill up. Just before starting need some advise..

  1. Whether fortify task should trigger before the build or after the build. We are using Fortify On Demand(SaaS), looking at accelerated building.

Any help would be much appreciated. Thank you!

1
You are asking 2 questions in one question. Please be specific, or separate this questions into 2 separate questions..Eriawan Kusumawardhono
Eriawan - consolidated the question.Renji

1 Answers

2
votes

Fortify on Demand requires a debug build including all dependencies to scan the code, so you must do it after the build.

Typically you would have a separate weekly build only for your Fortify scan. It does the debug build and uploads the artefact to Fortify on Demand. FoD will take some time to complete the scan, particularly if you have their staff reviewing the scan and removing false positives (manual review). False positives will still get through, as they do not know the context of your application.

Be aware that prior to doing automated scans, FoD requires a manual scan. If you try to do the automated scan without first doing the manual scan, you will get a cryptic error about entitlements.

You set this up by having 2 releases for the application. First do the manual release, which is accomplished by building in debug mode and zipping up the whole directory. You manually start the scan, uploading the zip.

When that completes, you create your second release, which is your automated scan. You import the results from the manual scan into the automated scan. From then on, the Azure plugin should work for the automated scans, until your subscription ends -- at that time you will have to do a manual scan after renewing your entitlements to make everything work again. It would be nice if they fixed this...