From e285c5c6a4eceef97457c088fb5befd97d9ac344 Mon Sep 17 00:00:00 2001 From: jeason Date: Wed, 14 Oct 2020 16:28:53 -0600 Subject: [PATCH 1/5] Project template: file templates --- .gitlab/CODEOWNERS | 6 +++ .gitlab/issue_templates/Access Request.md | 16 ++++++++ .../issue_templates/Application - Archive.md | 21 +++++++++++ .../issue_templates/Application - Initial.md | 32 ++++++++++++++++ .../issue_templates/Application - Update.md | 35 ++++++++++++++++++ .gitlab/issue_templates/Bug.md | 37 +++++++++++++++++++ .gitlab/issue_templates/Feature Request.md | 32 ++++++++++++++++ .../issue_templates/Leadership Question.md | 7 ++++ .gitlab/issue_templates/New Findings.md | 20 ++++++++++ .../issue_templates/Onboarding Question.md | 7 ++++ .gitlab/issue_templates/Pipeline Failure.md | 31 ++++++++++++++++ 11 files changed, 244 insertions(+) create mode 100644 .gitlab/CODEOWNERS create mode 100644 .gitlab/issue_templates/Access Request.md create mode 100644 .gitlab/issue_templates/Application - Archive.md create mode 100644 .gitlab/issue_templates/Application - Initial.md create mode 100644 .gitlab/issue_templates/Application - Update.md create mode 100644 .gitlab/issue_templates/Bug.md create mode 100644 .gitlab/issue_templates/Feature Request.md create mode 100644 .gitlab/issue_templates/Leadership Question.md create mode 100644 .gitlab/issue_templates/New Findings.md create mode 100644 .gitlab/issue_templates/Onboarding Question.md create mode 100644 .gitlab/issue_templates/Pipeline Failure.md diff --git a/.gitlab/CODEOWNERS b/.gitlab/CODEOWNERS new file mode 100644 index 0000000..64a2c68 --- /dev/null +++ b/.gitlab/CODEOWNERS @@ -0,0 +1,6 @@ +[Pipelines] +.gitlab-ci.yml @ironbank-notifications/cht +.gitlab-ci.yaml @ironbank-notifications/cht + +[Gitlab Configuration Files] +.gitlab/* @ironbank-notifications/cht diff --git a/.gitlab/issue_templates/Access Request.md b/.gitlab/issue_templates/Access Request.md new file mode 100644 index 0000000..1a7b224 --- /dev/null +++ b/.gitlab/issue_templates/Access Request.md @@ -0,0 +1,16 @@ +## Summary + +The following individuals are requesting access to this project (one per line): +(List or tag all individuals here) + + +The access level should be: +- [ ] Developer access +- [ ] Remove access + + +## Definition of Done +- [ ] All accounts have been provided the necessary accesses + + +/label ~"Access" ~"To Do" \ No newline at end of file diff --git a/.gitlab/issue_templates/Application - Archive.md b/.gitlab/issue_templates/Application - Archive.md new file mode 100644 index 0000000..9f3b5fe --- /dev/null +++ b/.gitlab/issue_templates/Application - Archive.md @@ -0,0 +1,21 @@ +## Summary + +Requesting this application be archived due to one of the following reasons: +- [ ] Version is no longer supported by vendor +- [ ] Application is End-Of-Life +- [ ] License violation. +- [ ] Other. See below. + +## Detailed Description + +(Please provide a detailed description of why this application should be archived) + + +## Definition of Done +- [ ] Application has been reviewed for archival +- [ ] Project is officially marked as stale +- [ ] Iron Bank frontend no longer lists application as available or approved + + +/label ~"Container::Archive" +/cc @ironbank-notifications/archive \ No newline at end of file diff --git a/.gitlab/issue_templates/Application - Initial.md b/.gitlab/issue_templates/Application - Initial.md new file mode 100644 index 0000000..6594a05 --- /dev/null +++ b/.gitlab/issue_templates/Application - Initial.md @@ -0,0 +1,32 @@ +## Summary + +Requesting application to be hardened. This is only for initial hardening of a container. + + +## Version Information + +Current version: (State the current version of the application as you see it) + +Under support: (Is the updated version within the same major version of the application or is this a new major version?) + + +## Definition of Done +Hardening: +- [ ] Container builds successfully +- [ ] Greylist file has been created (requires a member from container hardening) +- [ ] Branch has been merged into `development` + +Justifications: +- [ ] All findings have been justified per the above documentation +- [ ] Justifications have been provided to the container hardening team + +Approval Process (container hardening team processes): +- [ ] Peer review from Container Hardening Team +- [ ] Findings Approver has reviewed and approved all justifications +- [ ] Approval request has been sent to Authorizing Official +- [ ] Approval request has been processed by Authorizing Official + + + +/label ~"Container::Initial" +/cc @ironbank-notifications/cht \ No newline at end of file diff --git a/.gitlab/issue_templates/Application - Update.md b/.gitlab/issue_templates/Application - Update.md new file mode 100644 index 0000000..caebb3e --- /dev/null +++ b/.gitlab/issue_templates/Application - Update.md @@ -0,0 +1,35 @@ +## Summary + +Requesting application be updated to a newer version. + + + +## Version Information + +Current version: (State the current version of the application as you see it) + +Updated version: (State the version you would like the application updated to) + +Under support: (Is the updated version within the same major version of the application or is this a new major version?) + + +## Definition of Done +Hardening: +- [ ] Container builds successfully +- [ ] Container version has been updated in greylist file +- [ ] Branch has been merged into `development` + +Justifications: +- [ ] All findings have been justified per the above documentation +- [ ] Justifications have been provided to the container hardening team + +Approval Process: +- [ ] Peer review from Container Hardening Team +- [ ] Findings Approver has reviewed and approved all justifications +- [ ] Approval request has been sent to Authorizing Official +- [ ] Approval request has been processed by Authorizing Official + + + +/label ~"Container::Update" +/cc @ironbank-notifications/updates \ No newline at end of file diff --git a/.gitlab/issue_templates/Bug.md b/.gitlab/issue_templates/Bug.md new file mode 100644 index 0000000..1427a0c --- /dev/null +++ b/.gitlab/issue_templates/Bug.md @@ -0,0 +1,37 @@ +## Summary + +(Summarize the bug encountered concisely) + + +## Steps to reproduce + +(How one can reproduce the issue - this is very important) + + +## What is the current bug behavior? + +(What actually happens) + + +## What is the expected correct behavior? + +(What you should see instead) + + +## Relevant logs and/or screenshots + +(Paste any relevant logs - please use code blocks (```) to format console output, +logs, and code as it's very hard to read otherwise.) + + +## Possible fixes + +(If you can, link to the line of code that might be responsible for the problem) + + +## Defintion of Done +- [ ] Bug has been identified and corrected within the container + + +/label ~Bug +/cc @ironbank-notifications/bug \ No newline at end of file diff --git a/.gitlab/issue_templates/Feature Request.md b/.gitlab/issue_templates/Feature Request.md new file mode 100644 index 0000000..a0e2f19 --- /dev/null +++ b/.gitlab/issue_templates/Feature Request.md @@ -0,0 +1,32 @@ +## Feature description + +(Detailed description of the feature being requested) + + +## Use cases + + +(Detailed description of the use case for this feature) + + +## Benefits + +(How does this benefit others) + + +## Requirements + +(Any requirements for this feature to be enabled?) + + +## Links / references + +(List of links or references that support this feature) + + +## Definition of Done +- [ ] Feature has been implemented + + +/label ~Feature +/cc @ironbank-notifications/feature \ No newline at end of file diff --git a/.gitlab/issue_templates/Leadership Question.md b/.gitlab/issue_templates/Leadership Question.md new file mode 100644 index 0000000..4674f82 --- /dev/null +++ b/.gitlab/issue_templates/Leadership Question.md @@ -0,0 +1,7 @@ +## Leadership question + +(Detailed description of the question you'd like to ask the leadership team) + + +/label ~"Question::Leadership" ~"To Do" +/cc @ironbank-notifications/leadership \ No newline at end of file diff --git a/.gitlab/issue_templates/New Findings.md b/.gitlab/issue_templates/New Findings.md new file mode 100644 index 0000000..068d029 --- /dev/null +++ b/.gitlab/issue_templates/New Findings.md @@ -0,0 +1,20 @@ +## Summary + +Container has new findings discovered during continuous monitoring. + + + +## Definition of Done +Justifications: +- [ ] All findings have been justified +- [ ] Justifications have been provided to the container hardening team + +Approval Process: +- [ ] Findings Approver has reviewed and approved all justifications +- [ ] Approval request has been sent to Authorizing Official +- [ ] Approval request has been processed by Authorizing Official + + + +/label ~"Container::New Findings" +/cc @ironbank-notifications/security \ No newline at end of file diff --git a/.gitlab/issue_templates/Onboarding Question.md b/.gitlab/issue_templates/Onboarding Question.md new file mode 100644 index 0000000..77dea11 --- /dev/null +++ b/.gitlab/issue_templates/Onboarding Question.md @@ -0,0 +1,7 @@ +## Onboarding question + +(Detailed description of the question you'd like to ask the onboarding team) + + +/label ~"Question::Onboarding" ~"To Do" +/cc @ironbank-notifications/onboarding \ No newline at end of file diff --git a/.gitlab/issue_templates/Pipeline Failure.md b/.gitlab/issue_templates/Pipeline Failure.md new file mode 100644 index 0000000..28b82a9 --- /dev/null +++ b/.gitlab/issue_templates/Pipeline Failure.md @@ -0,0 +1,31 @@ +## Summary + +(Summarize the pipeline issue encountered concisely) + + +## Link to failed pipeline + +(Link to the failed pipeline) + + +## What is the current bug behavior? + +(What actually happens) + + +## What is the expected correct behavior? + +(What you should see instead) + + +## Possible fixes + +(If you can, link to the line of code that might be responsible for the problem) + + +## Definition of Done +- [ ] Pipeline failure has been resolved + + +/label ~Pipeline +/cc @ironbank-notifications/pipelines \ No newline at end of file -- GitLab From 6dc810af8d9173b131fde580f764b6f5c4eef1b0 Mon Sep 17 00:00:00 2001 From: ironbank-bot Date: Thu, 10 Dec 2020 01:25:56 +0000 Subject: [PATCH 2/5] Migrate to hardening_manifest.yaml --- Dockerfile | 20 +------------- Jenkinsfile | 2 -- download.yaml | 8 ------ hardening_manifest.yaml | 58 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 59 insertions(+), 29 deletions(-) delete mode 100644 Jenkinsfile delete mode 100644 download.yaml create mode 100644 hardening_manifest.yaml diff --git a/Dockerfile b/Dockerfile index 9928d80..aeaba15 100644 --- a/Dockerfile +++ b/Dockerfile @@ -20,25 +20,7 @@ FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} # Local testing # FROM localhost/redhat/openjdk/openjdk8:1.8.0 -LABEL name="Nexus IQ Server image" \ - vendor=Sonatype \ - version="1.100.0-01" \ - release="1.100.0" \ - url="https://www.sonatype.com" \ - summary="The Nexus IQ Server" \ - description="Nexus IQ Server is a policy engine powered by precise intelligence on open source components. \ - It provides a number of tools to improve component usage in your software supply chain, allowing you to \ - automate your processes and achieve accelerated speed to delivery while also increasing product quality" \ - com.sonatype.license="Apache License, Version 2.0" \ - com.sonatype.name="Nexus IQ Server image" \ - run="docker run -d -p 8070:8070 -p 8071:8071 IMAGE" \ - com.sonatype.name="Nexus IQ Server base image" \ - io.k8s.description="Nexus IQ Server is a policy engine powered by precise intelligence on open source components. \ - It provides a number of tools to improve component usage in your software supply chain, allowing you to \ - automate your processes and achieve accelerated speed to delivery while also increasing product quality" \ - io.k8s.display-name="Nexus IQ Server" \ - io.openshift.expose-services="8071:8071" \ - io.openshift.tags="Sonatype,Nexus,IQ Server" +LABEL com.sonatype.name="Nexus IQ Server base image" # Optional parameters. Uncomment to override default: ARG IQ_SERVER_VERSION=1.100.0-01 diff --git a/Jenkinsfile b/Jenkinsfile deleted file mode 100644 index 5c98b07..0000000 --- a/Jenkinsfile +++ /dev/null @@ -1,2 +0,0 @@ -@Library('DCCSCR@master') _ -dccscrPipeline( version: "1.100.0-01") \ No newline at end of file diff --git a/download.yaml b/download.yaml deleted file mode 100644 index f547eed..0000000 --- a/download.yaml +++ /dev/null @@ -1,8 +0,0 @@ -resources: - - url: "https://download.sonatype.com/clm/server/nexus-iq-server-1.100.0-01-bundle.tar.gz" - filename: "nexus-iq-server-bundle.tar.gz" # [required field] desired staging name for the build context - validation: - type: "sha256" # supported: sha256, sha1, sha224, sha512, PGP - value: "0a26e4ad5c2f322622087de51caa6858e9fa3b908f69518cb82b43b142704c63" - # if the file you pull is from a github repo, make sure this is the official repo for that file, - # and indicate that in a comment in this file diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml new file mode 100644 index 0000000..ed90b68 --- /dev/null +++ b/hardening_manifest.yaml @@ -0,0 +1,58 @@ +--- +apiVersion: v1 + +# The repository name in registry1, excluding /ironbank/ +name: "sonatype/nexus-iq-server/nexus-iq-server" + +# List of tags to push for the repository in registry1 +# The most specific version should be the first tag and will be shown +# on ironbank.dsop.io +tags: +- "1.100.0-01" +- "latest" + +# Build args passed to Dockerfile ARGs +args: + BASE_IMAGE: "redhat/openjdk/openjdk8" + BASE_TAG: "1.8.0" + +# Docker image labels +labels: + org.opencontainers.image.title: "nexus-iq-server" + ## Human-readable description of the software packaged in the image + # org.opencontainers.image.description: "FIXME" + ## License(s) under which contained software is distributed + # org.opencontainers.image.licenses: "FIXME" + ## URL to find more information on the image + # org.opencontainers.image.url: "FIXME" + ## Name of the distributing entity, organization or individual + # org.opencontainers.image.vendor: "FIXME" + org.opencontainers.image.version: "1.100.0-01" + ## Keywords to help with search (ex. "cicd,gitops,golang") + # mil.dso.ironbank.image.keywords: "FIXME" + ## This value can be "opensource" or "commercial" + # mil.dso.ironbank.image.type: "FIXME" + ## Product the image belongs to for grouping multiple images + # mil.dso.ironbank.product.name: "FIXME" + +# List of resources to make available to the offline build context +resources: +- filename: nexus-iq-server-bundle.tar.gz + url: https://download.sonatype.com/clm/server/nexus-iq-server-1.100.0-01-bundle.tar.gz + validation: + type: sha256 + value: 0a26e4ad5c2f322622087de51caa6858e9fa3b908f69518cb82b43b142704c63 + +# List of project maintainers +# FIXME: Fill in the following details for the current container owner in the whitelist +# FIXME: Include any other vendor information if applicable +maintainers: +- email: "bbeard@sonatype.com" +# # The name of the current container owner +# name: "FIXME" +# # The gitlab username of the current container owner +# username: "FIXME" +# cht_member: true # FIXME: Uncomment if the maintainer is a member of CHT +# - name: "FIXME" +# username: "FIXME" +# email: "FIXME" -- GitLab From 0f3e4fe86619cff421493cb14538e6338b1a6dbd Mon Sep 17 00:00:00 2001 From: cvernooy Date: Fri, 11 Dec 2020 15:48:28 +0000 Subject: [PATCH 3/5] Update hardening_manifest.yaml --- hardening_manifest.yaml | 42 ++++++++++++++--------------------------- 1 file changed, 14 insertions(+), 28 deletions(-) diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml index ed90b68..40a2608 100644 --- a/hardening_manifest.yaml +++ b/hardening_manifest.yaml @@ -4,36 +4,23 @@ apiVersion: v1 # The repository name in registry1, excluding /ironbank/ name: "sonatype/nexus-iq-server/nexus-iq-server" -# List of tags to push for the repository in registry1 -# The most specific version should be the first tag and will be shown -# on ironbank.dsop.io tags: - "1.100.0-01" - "latest" - -# Build args passed to Dockerfile ARGs args: BASE_IMAGE: "redhat/openjdk/openjdk8" BASE_TAG: "1.8.0" -# Docker image labels labels: org.opencontainers.image.title: "nexus-iq-server" - ## Human-readable description of the software packaged in the image - # org.opencontainers.image.description: "FIXME" - ## License(s) under which contained software is distributed - # org.opencontainers.image.licenses: "FIXME" - ## URL to find more information on the image - # org.opencontainers.image.url: "FIXME" - ## Name of the distributing entity, organization or individual - # org.opencontainers.image.vendor: "FIXME" + org.opencontainers.image.description: "nexus-iq-server" + org.opencontainers.image.licenses: "Apache-2.0" + org.opencontainers.image.url: "download.sonatype.com/clm/server/nexus-iq-server-1.100.0-01-bundle.tar.gz" + org.opencontainers.image.vendor: "Sonaatype" org.opencontainers.image.version: "1.100.0-01" - ## Keywords to help with search (ex. "cicd,gitops,golang") - # mil.dso.ironbank.image.keywords: "FIXME" - ## This value can be "opensource" or "commercial" - # mil.dso.ironbank.image.type: "FIXME" - ## Product the image belongs to for grouping multiple images - # mil.dso.ironbank.product.name: "FIXME" + mil.dso.ironbank.image.keywords: "nexus,iq-server,sonatype" + mil.dso.ironbank.image.type: "commercial" + mil.dso.ironbank.product.name: "Nexus IQ Server" # List of resources to make available to the offline build context resources: @@ -48,11 +35,10 @@ resources: # FIXME: Include any other vendor information if applicable maintainers: - email: "bbeard@sonatype.com" -# # The name of the current container owner -# name: "FIXME" -# # The gitlab username of the current container owner -# username: "FIXME" -# cht_member: true # FIXME: Uncomment if the maintainer is a member of CHT -# - name: "FIXME" -# username: "FIXME" -# email: "FIXME" + name: "Brian Beard" + username: "bbeard" + cht_member: false +- email: "cvernooy@oteemo.com" + name: "Christopher Vernooy" + username: "cvernooy" + cht_member: true -- GitLab From 96afe2ba5f82396852855e5ec26fbd18c0066be9 Mon Sep 17 00:00:00 2001 From: "sean.melissari" Date: Sat, 13 Feb 2021 03:25:30 +0000 Subject: [PATCH 4/5] fix version --- scripts/start-nexus-iq-server.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/start-nexus-iq-server.sh b/scripts/start-nexus-iq-server.sh index 92868ce..0483fc4 100755 --- a/scripts/start-nexus-iq-server.sh +++ b/scripts/start-nexus-iq-server.sh @@ -5,4 +5,4 @@ cd /opt/sonatype/nexus-iq-server/ -exec /usr/bin/java ${JAVA_OPTS} -jar /opt/sonatype/nexus-iq-server/nexus-iq-server-1.98.0-01.jar server /etc/nexus-iq-server/config.yml +exec /usr/bin/java ${JAVA_OPTS} -jar /opt/sonatype/nexus-iq-server/nexus-iq-server-1.100.0-01.jar server /etc/nexus-iq-server/config.yml -- GitLab From 92c1eee0e827684ce938c89380492ef9cd99b0a9 Mon Sep 17 00:00:00 2001 From: "sean.melissari" Date: Thu, 18 Feb 2021 14:57:37 +0000 Subject: [PATCH 5/5] remove label --- Dockerfile | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index aeaba15..56d8898 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG BASE_REGISTRY=registry1.dsop.io +ARG BASE_REGISTRY=registry1.dso.mil ARG BASE_IMAGE=ironbank/redhat/openjdk/openjdk8 ARG BASE_TAG=1.8 @@ -20,8 +20,6 @@ FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} # Local testing # FROM localhost/redhat/openjdk/openjdk8:1.8.0 -LABEL com.sonatype.name="Nexus IQ Server base image" - # Optional parameters. Uncomment to override default: ARG IQ_SERVER_VERSION=1.100.0-01 #ARG NEXUS_DOWNLOAD_URL=https://download.sonatype.com/clm/server/nexus-iq-server-${IQ_SERVER_VERSION}-bundle.tar.gz @@ -66,4 +64,4 @@ USER nexus ENV JAVA_OPTS="-Djava.util.prefs.userRoot=${SONATYPE_WORK}/javaprefs" -CMD ["sh", "-c", "${IQ_HOME}/start-nexus-iq-server.sh"] \ No newline at end of file +CMD ["sh", "-c", "${IQ_HOME}/start-nexus-iq-server.sh"] -- GitLab