Search code examples
teamcityfortify

Integrating Fortify into a Build Process

I am attempting to see if I can integrate Fortify scans into my build process. I have done some research, but can't seem to find anyway to extract scripts from Fortify's audit workbench. Is this at all possible? Should I just build a batch file to accomplish this?

Solution

  • Building your own batch file would be the best approach.

    You can get information on scanning your projects from the HPE Security Fortify Static Code Analyzer User Guide and from help file of the commandline sourceanalyzer -h

    It really is a three step process

    1. Clean
    2. Translate
    3. Scan

    There are examples at the top of the help file.

    If you wanted, you could also use the Scan Wizard tool, but personally I do not like using it for build integration long term. It creates a complicated batch file, it specifies files specifically (so if new files get added over time it will not pick them up).

    If you want to know how Audit workbench performs it scans, you can add the following command options: "-verbose" "-debug" "-logfile" "c:\temp\translate.log" or "c:\temp\scan.log"

    Screenshot of Audit Workbench with the above commands inserted into the translation and scan portions

    Then you can look at the log files for the line that is "Args:" This will contain a list of arguments (in quotes and separated by commas) of what command-line arguments were passed to sourceanalyzer.exe.

    With this information, you could create a batch file to run and perform the scan. (Make sure the batch file has all three steps I mentioned earlier).

    The GUIs are just a front end for sourceanalyzer.exe