Search code examples
fortify

Fortify Scan Append option using maven plugin

How can i append fpr report using maven plugin? Is it possible to do scan -append using maven fortify commands?

Solution

  • No, you cannot do this directly with the maven plugin. Merging and -append are different bits of functionality.

    You could however use this by just performing the translation stage with maven, such as: 

    $sourceanalyzer -b my_maven_test -clean
$sourceanalyzer -b my_maven_test mvn sca:translate
$sourceanalyzer -b my_maven_test -scan -f results.fpr -append

    Unfortunately this is the only way to currently get this functionality. However there are subsequent issues with appending (such as the code should be completely logically independent to be scanned separately ..which can be surprisingly difficult to determine) and can be harder to maintain the scanning process going forward. I would generally advise to try and scan the entire project in one go if at all possible.