diff --git a/.gitlab/CODEOWNERS b/.gitlab/CODEOWNERS new file mode 100644 index 0000000000000000000000000000000000000000..64a2c68c3ababda8d526d6cd995f02cd36f837ab --- /dev/null +++ b/.gitlab/CODEOWNERS @@ -0,0 +1,6 @@ +[Pipelines] +.gitlab-ci.yml @ironbank-notifications/cht +.gitlab-ci.yaml @ironbank-notifications/cht + +[Gitlab Configuration Files] +.gitlab/* @ironbank-notifications/cht diff --git a/.gitlab/issue_templates/Access Request.md b/.gitlab/issue_templates/Access Request.md new file mode 100644 index 0000000000000000000000000000000000000000..1a7b224d6ccdad95fef69b5c8be1ce2b543f338e --- /dev/null +++ b/.gitlab/issue_templates/Access Request.md @@ -0,0 +1,16 @@ +## Summary + +The following individuals are requesting access to this project (one per line): +(List or tag all individuals here) + + +The access level should be: +- [ ] Developer access +- [ ] Remove access + + +## Definition of Done +- [ ] All accounts have been provided the necessary accesses + + +/label ~"Access" ~"To Do" \ No newline at end of file diff --git a/.gitlab/issue_templates/Application - Archive.md b/.gitlab/issue_templates/Application - Archive.md new file mode 100644 index 0000000000000000000000000000000000000000..9f3b5fe4d8d43ae9f82411a391b200d4b43f2668 --- /dev/null +++ b/.gitlab/issue_templates/Application - Archive.md @@ -0,0 +1,21 @@ +## Summary + +Requesting this application be archived due to one of the following reasons: +- [ ] Version is no longer supported by vendor +- [ ] Application is End-Of-Life +- [ ] License violation. +- [ ] Other. See below. + +## Detailed Description + +(Please provide a detailed description of why this application should be archived) + + +## Definition of Done +- [ ] Application has been reviewed for archival +- [ ] Project is officially marked as stale +- [ ] Iron Bank frontend no longer lists application as available or approved + + +/label ~"Container::Archive" +/cc @ironbank-notifications/archive \ No newline at end of file diff --git a/.gitlab/issue_templates/Application - Initial.md b/.gitlab/issue_templates/Application - Initial.md new file mode 100644 index 0000000000000000000000000000000000000000..6594a0580b941815c0c7c6264cdfc42e28231f57 --- /dev/null +++ b/.gitlab/issue_templates/Application - Initial.md @@ -0,0 +1,32 @@ +## Summary + +Requesting application to be hardened. This is only for initial hardening of a container. + + +## Version Information + +Current version: (State the current version of the application as you see it) + +Under support: (Is the updated version within the same major version of the application or is this a new major version?) + + +## Definition of Done +Hardening: +- [ ] Container builds successfully +- [ ] Greylist file has been created (requires a member from container hardening) +- [ ] Branch has been merged into `development` + +Justifications: +- [ ] All findings have been justified per the above documentation +- [ ] Justifications have been provided to the container hardening team + +Approval Process (container hardening team processes): +- [ ] Peer review from Container Hardening Team +- [ ] Findings Approver has reviewed and approved all justifications +- [ ] Approval request has been sent to Authorizing Official +- [ ] Approval request has been processed by Authorizing Official + + + +/label ~"Container::Initial" +/cc @ironbank-notifications/cht \ No newline at end of file diff --git a/.gitlab/issue_templates/Application - Update.md b/.gitlab/issue_templates/Application - Update.md new file mode 100644 index 0000000000000000000000000000000000000000..caebb3e9aab279c7f109ec0fbfa246b8add6d972 --- /dev/null +++ b/.gitlab/issue_templates/Application - Update.md @@ -0,0 +1,35 @@ +## Summary + +Requesting application be updated to a newer version. + + + +## Version Information + +Current version: (State the current version of the application as you see it) + +Updated version: (State the version you would like the application updated to) + +Under support: (Is the updated version within the same major version of the application or is this a new major version?) + + +## Definition of Done +Hardening: +- [ ] Container builds successfully +- [ ] Container version has been updated in greylist file +- [ ] Branch has been merged into `development` + +Justifications: +- [ ] All findings have been justified per the above documentation +- [ ] Justifications have been provided to the container hardening team + +Approval Process: +- [ ] Peer review from Container Hardening Team +- [ ] Findings Approver has reviewed and approved all justifications +- [ ] Approval request has been sent to Authorizing Official +- [ ] Approval request has been processed by Authorizing Official + + + +/label ~"Container::Update" +/cc @ironbank-notifications/updates \ No newline at end of file diff --git a/.gitlab/issue_templates/Bug.md b/.gitlab/issue_templates/Bug.md new file mode 100644 index 0000000000000000000000000000000000000000..1427a0caed1833bccd3b1e5f8c5f6eafde05266c --- /dev/null +++ b/.gitlab/issue_templates/Bug.md @@ -0,0 +1,37 @@ +## Summary + +(Summarize the bug encountered concisely) + + +## Steps to reproduce + +(How one can reproduce the issue - this is very important) + + +## What is the current bug behavior? + +(What actually happens) + + +## What is the expected correct behavior? + +(What you should see instead) + + +## Relevant logs and/or screenshots + +(Paste any relevant logs - please use code blocks (```) to format console output, +logs, and code as it's very hard to read otherwise.) + + +## Possible fixes + +(If you can, link to the line of code that might be responsible for the problem) + + +## Defintion of Done +- [ ] Bug has been identified and corrected within the container + + +/label ~Bug +/cc @ironbank-notifications/bug \ No newline at end of file diff --git a/.gitlab/issue_templates/Feature Request.md b/.gitlab/issue_templates/Feature Request.md new file mode 100644 index 0000000000000000000000000000000000000000..a0e2f195dc66e4187264381c5e96e8aa96db8a09 --- /dev/null +++ b/.gitlab/issue_templates/Feature Request.md @@ -0,0 +1,32 @@ +## Feature description + +(Detailed description of the feature being requested) + + +## Use cases + + +(Detailed description of the use case for this feature) + + +## Benefits + +(How does this benefit others) + + +## Requirements + +(Any requirements for this feature to be enabled?) + + +## Links / references + +(List of links or references that support this feature) + + +## Definition of Done +- [ ] Feature has been implemented + + +/label ~Feature +/cc @ironbank-notifications/feature \ No newline at end of file diff --git a/.gitlab/issue_templates/Leadership Question.md b/.gitlab/issue_templates/Leadership Question.md new file mode 100644 index 0000000000000000000000000000000000000000..4674f82f930085f34f51b4ecbb4d396519f53192 --- /dev/null +++ b/.gitlab/issue_templates/Leadership Question.md @@ -0,0 +1,7 @@ +## Leadership question + +(Detailed description of the question you'd like to ask the leadership team) + + +/label ~"Question::Leadership" ~"To Do" +/cc @ironbank-notifications/leadership \ No newline at end of file diff --git a/.gitlab/issue_templates/New Findings.md b/.gitlab/issue_templates/New Findings.md new file mode 100644 index 0000000000000000000000000000000000000000..068d029d89cb62dd4d4da5e03924c608172d97d6 --- /dev/null +++ b/.gitlab/issue_templates/New Findings.md @@ -0,0 +1,20 @@ +## Summary + +Container has new findings discovered during continuous monitoring. + + + +## Definition of Done +Justifications: +- [ ] All findings have been justified +- [ ] Justifications have been provided to the container hardening team + +Approval Process: +- [ ] Findings Approver has reviewed and approved all justifications +- [ ] Approval request has been sent to Authorizing Official +- [ ] Approval request has been processed by Authorizing Official + + + +/label ~"Container::New Findings" +/cc @ironbank-notifications/security \ No newline at end of file diff --git a/.gitlab/issue_templates/Onboarding Question.md b/.gitlab/issue_templates/Onboarding Question.md new file mode 100644 index 0000000000000000000000000000000000000000..77dea11e56c87d3fb65a1cf2ce7901621058f970 --- /dev/null +++ b/.gitlab/issue_templates/Onboarding Question.md @@ -0,0 +1,7 @@ +## Onboarding question + +(Detailed description of the question you'd like to ask the onboarding team) + + +/label ~"Question::Onboarding" ~"To Do" +/cc @ironbank-notifications/onboarding \ No newline at end of file diff --git a/.gitlab/issue_templates/Pipeline Failure.md b/.gitlab/issue_templates/Pipeline Failure.md new file mode 100644 index 0000000000000000000000000000000000000000..28b82a9454358a542efaa4b9c1c99542e3487fd6 --- /dev/null +++ b/.gitlab/issue_templates/Pipeline Failure.md @@ -0,0 +1,31 @@ +## Summary + +(Summarize the pipeline issue encountered concisely) + + +## Link to failed pipeline + +(Link to the failed pipeline) + + +## What is the current bug behavior? + +(What actually happens) + + +## What is the expected correct behavior? + +(What you should see instead) + + +## Possible fixes + +(If you can, link to the line of code that might be responsible for the problem) + + +## Definition of Done +- [ ] Pipeline failure has been resolved + + +/label ~Pipeline +/cc @ironbank-notifications/pipelines \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index 9928d80f3b316e52f87382876425e6dca1f944e5..56d8898440492280c98051575801ceb84b54c979 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG BASE_REGISTRY=registry1.dsop.io +ARG BASE_REGISTRY=registry1.dso.mil ARG BASE_IMAGE=ironbank/redhat/openjdk/openjdk8 ARG BASE_TAG=1.8 @@ -20,26 +20,6 @@ FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} # Local testing # FROM localhost/redhat/openjdk/openjdk8:1.8.0 -LABEL name="Nexus IQ Server image" \ - vendor=Sonatype \ - version="1.100.0-01" \ - release="1.100.0" \ - url="https://www.sonatype.com" \ - summary="The Nexus IQ Server" \ - description="Nexus IQ Server is a policy engine powered by precise intelligence on open source components. \ - It provides a number of tools to improve component usage in your software supply chain, allowing you to \ - automate your processes and achieve accelerated speed to delivery while also increasing product quality" \ - com.sonatype.license="Apache License, Version 2.0" \ - com.sonatype.name="Nexus IQ Server image" \ - run="docker run -d -p 8070:8070 -p 8071:8071 IMAGE" \ - com.sonatype.name="Nexus IQ Server base image" \ - io.k8s.description="Nexus IQ Server is a policy engine powered by precise intelligence on open source components. \ - It provides a number of tools to improve component usage in your software supply chain, allowing you to \ - automate your processes and achieve accelerated speed to delivery while also increasing product quality" \ - io.k8s.display-name="Nexus IQ Server" \ - io.openshift.expose-services="8071:8071" \ - io.openshift.tags="Sonatype,Nexus,IQ Server" - # Optional parameters. Uncomment to override default: ARG IQ_SERVER_VERSION=1.100.0-01 #ARG NEXUS_DOWNLOAD_URL=https://download.sonatype.com/clm/server/nexus-iq-server-${IQ_SERVER_VERSION}-bundle.tar.gz @@ -84,4 +64,4 @@ USER nexus ENV JAVA_OPTS="-Djava.util.prefs.userRoot=${SONATYPE_WORK}/javaprefs" -CMD ["sh", "-c", "${IQ_HOME}/start-nexus-iq-server.sh"] \ No newline at end of file +CMD ["sh", "-c", "${IQ_HOME}/start-nexus-iq-server.sh"] diff --git a/Jenkinsfile b/Jenkinsfile deleted file mode 100644 index 5c98b07a072bbb70ca4472bb44471235a2aa6813..0000000000000000000000000000000000000000 --- a/Jenkinsfile +++ /dev/null @@ -1,2 +0,0 @@ -@Library('DCCSCR@master') _ -dccscrPipeline( version: "1.100.0-01") \ No newline at end of file diff --git a/download.yaml b/download.yaml deleted file mode 100644 index f547eedea39029d309124c7c20b925c118aa396c..0000000000000000000000000000000000000000 --- a/download.yaml +++ /dev/null @@ -1,8 +0,0 @@ -resources: - - url: "https://download.sonatype.com/clm/server/nexus-iq-server-1.100.0-01-bundle.tar.gz" - filename: "nexus-iq-server-bundle.tar.gz" # [required field] desired staging name for the build context - validation: - type: "sha256" # supported: sha256, sha1, sha224, sha512, PGP - value: "0a26e4ad5c2f322622087de51caa6858e9fa3b908f69518cb82b43b142704c63" - # if the file you pull is from a github repo, make sure this is the official repo for that file, - # and indicate that in a comment in this file diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml new file mode 100644 index 0000000000000000000000000000000000000000..40a2608e64676e048e3405188df031fe6be8ff83 --- /dev/null +++ b/hardening_manifest.yaml @@ -0,0 +1,44 @@ +--- +apiVersion: v1 + +# The repository name in registry1, excluding /ironbank/ +name: "sonatype/nexus-iq-server/nexus-iq-server" + +tags: +- "1.100.0-01" +- "latest" +args: + BASE_IMAGE: "redhat/openjdk/openjdk8" + BASE_TAG: "1.8.0" + +labels: + org.opencontainers.image.title: "nexus-iq-server" + org.opencontainers.image.description: "nexus-iq-server" + org.opencontainers.image.licenses: "Apache-2.0" + org.opencontainers.image.url: "download.sonatype.com/clm/server/nexus-iq-server-1.100.0-01-bundle.tar.gz" + org.opencontainers.image.vendor: "Sonaatype" + org.opencontainers.image.version: "1.100.0-01" + mil.dso.ironbank.image.keywords: "nexus,iq-server,sonatype" + mil.dso.ironbank.image.type: "commercial" + mil.dso.ironbank.product.name: "Nexus IQ Server" + +# List of resources to make available to the offline build context +resources: +- filename: nexus-iq-server-bundle.tar.gz + url: https://download.sonatype.com/clm/server/nexus-iq-server-1.100.0-01-bundle.tar.gz + validation: + type: sha256 + value: 0a26e4ad5c2f322622087de51caa6858e9fa3b908f69518cb82b43b142704c63 + +# List of project maintainers +# FIXME: Fill in the following details for the current container owner in the whitelist +# FIXME: Include any other vendor information if applicable +maintainers: +- email: "bbeard@sonatype.com" + name: "Brian Beard" + username: "bbeard" + cht_member: false +- email: "cvernooy@oteemo.com" + name: "Christopher Vernooy" + username: "cvernooy" + cht_member: true diff --git a/scripts/start-nexus-iq-server.sh b/scripts/start-nexus-iq-server.sh index 92868ce7e89e216501882d1fe2cbac0ba8cc7b8f..0483fc4f4691b8fe9e779ad16c7472abba56565e 100755 --- a/scripts/start-nexus-iq-server.sh +++ b/scripts/start-nexus-iq-server.sh @@ -5,4 +5,4 @@ cd /opt/sonatype/nexus-iq-server/ -exec /usr/bin/java ${JAVA_OPTS} -jar /opt/sonatype/nexus-iq-server/nexus-iq-server-1.98.0-01.jar server /etc/nexus-iq-server/config.yml +exec /usr/bin/java ${JAVA_OPTS} -jar /opt/sonatype/nexus-iq-server/nexus-iq-server-1.100.0-01.jar server /etc/nexus-iq-server/config.yml