fastlane-plugin-dependency_check_ios_analyzer 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e345f12b5563a7925a7e3f9f68bec30cba87d77c008549f6894a2f2466933bd
-  data.tar.gz: d1c5771351ae90caaf6cde75684fdffdb60a63513f0ea6d6a7464c0a712cd506
+  metadata.gz: 9ef35dee5ad3ab22fd56bfaf812d32cd3583eafaa89774396d564a62f6631230
+  data.tar.gz: c44a3437fe94b288b9ea0cbf8dce854a5e12b7ee3c23a197a6288be659a81ab1
 SHA512:
-  metadata.gz: 00d998579a40c7ff824191c74cdbdae8189c3391a9fc081517798967612d714f71470d0480835dae02bc33526d5982202e1591abf517fa79b34c7cb5124266dc
-  data.tar.gz: 224c59d4cb97b25fdc1dd22983a921b37eed9267bf2903feffe7bdebe8a3c8533da982345dfff2324ed17143c1e03b3f5ad3c9030c55c7f34f68fca9047bb5a6
+  metadata.gz: e9a8999284bec6d083ac6fc8bf2d77ac5b55b8edbf5cadfd6ce6a43b4ab6cd105c24d7820294bfc37ec768d364562095fa1e87ddbcc6a39aaf88133c0eb93050
+  data.tar.gz: 59dc152c71bc7fe5b6aa00687cfd60dd7fee57ee5370243d982ca5639dffa9e62f5877b9b213612632d748e2e4108c0ffcb3a02594fa750fab38f3e5e3fdee4c

data/README.md

@@ -21,7 +21,7 @@ This analyzer is considered experimental. While it may be useful and provide val
 | `output_directory` | The directory in which all reports will be stored | `dependency-check` |
 | `output_types` | Comma separated list of the output types (e.g. `html`, `xml`, `csv`, `json`, `junit`, `sarif`, `all`) | `sarif` |
 | `cli_version` | Overwrite the version of `DependencyCheck` analyzer | `6.1.6` |
-| `gpg_key` | Overwrite the GPG key to verify the cryptographic integrity of the requested `cli_version` | |
+| `verify_integrity` | Verify the cryptographic integrity of the tool before starting an analysis | `false` |
 | `verbose` | The file path to write verbose logging information | |
 | `fail_on_cvss` | Specifies if the build should be failed if a CVSS score above a specified level is identified. Since the CVSS scores are 0-10, by default the build will never fail | `11` |
 | `junit_fail_on_cvss` | Specifies the CVSS score that is considered a failure when generating the junit report | `0` |

data/lib/fastlane/plugin/dependency_check_ios_analyzer/actions/dependency_check_ios_analyzer_action.rb

@@ -115,11 +115,11 @@ module Fastlane
             type: String
           ),
           FastlaneCore::ConfigItem.new(
-            key: :gpg_key,
-            description: 'Overwrite the GPG key to verify the cryptographic integrity of the requested cli_version',
+            key: :verify_integrity,
+            description: 'Verify the cryptographic integrity of the tool before starting an analysis',
             optional: true,
-            is_string: true,
-            type: String
+            is_string: false,
+            type: Boolean
           ),
           FastlaneCore::ConfigItem.new(
             key: :verbose,

data/lib/fastlane/plugin/dependency_check_ios_analyzer/helper/configuration_helper.rb

@@ -11,11 +11,9 @@ module Fastlane
         repo = 'https://github.com/jeremylong/DependencyCheck'
         name = 'dependency-check'
         version = params[:cli_version] ? params[:cli_version] : '6.1.6'
-        gpg_key = params[:gpg_key] ? params[:gpg_key] : 'F9514E84AE3708288374BBBE097586CFEA37F9A6'
         base_url = "#{repo}/releases/download/v#{version}/#{name}-#{version}-release"
         bin_path = "#{params[:output_directory]}/#{name}/bin/#{name}.sh"
         zip_path = "#{params[:output_directory]}/#{name}.zip"
-        asc_path = "#{zip_path}.asc"
 
         unless File.exist?(bin_path)
           FileUtils.mkdir_p(params[:output_directory])
@@ -27,17 +25,13 @@ module Fastlane
             File.open(zip_path, 'w+') { |f| f.write(curl.body_str) }
           end
 
-          asc_url = "#{base_url}.zip.asc"
-          UI.message("🚀 Downloading associated GPG signature file: #{asc_url}")
-          curl = Curl.get(asc_url) { |curl| curl.follow_location = true }
-          File.open(asc_path, 'w+') { |f| f.write(curl.body_str) }
-
-          verify_cryptographic_integrity(asc_path: asc_path, gpg_key: gpg_key)
+          if params[:verify_integrity]
+            verify_cryptographic_integrity(zip_path: zip_path, base_url: base_url)
+          end
 
           unzip(file: zip_path, params: params)
 
           FileUtils.rm_rf(zip_path)
-          FileUtils.rm_rf(asc_path)
         end
 
         bin_path
@@ -70,13 +64,24 @@ module Fastlane
         end
       end
 
-      # https://jeremylong.github.io/DependencyCheck/dependency-check-cli/
-      def self.verify_cryptographic_integrity(asc_path:, gpg_key:)
+      def self.verify_cryptographic_integrity(zip_path:, base_url:)
+        asc_url = "#{base_url}.zip.asc"
+        UI.message("🚀 Downloading associated GPG signature file: #{asc_url}")
+        curl = Curl.get(asc_url) { |curl| curl.follow_location = true }
+
+        asc_path = "#{zip_path}.asc"
+        File.open(asc_path, 'w+') { |f| f.write(curl.body_str) }
+
+        # https://jeremylong.github.io/DependencyCheck/dependency-check-cli/
+        gpg_key = 'F9514E84AE3708288374BBBE097586CFEA37F9A6'
+
         UI.message("🕵️  Verifying the cryptographic integrity")
         # Import the GPG key used to sign all DependencyCheck releases
         Actions.sh("gpg --keyserver hkp://keys.gnupg.net --recv-keys #{gpg_key}")
         # Verify the cryptographic integrity
         Actions.sh("gpg --verify #{asc_path}")
+
+        FileUtils.rm_rf(asc_path)
       end
     end
   end

data/lib/fastlane/plugin/dependency_check_ios_analyzer/version.rb

@@ -1,5 +1,5 @@
 module Fastlane
   module DependencyCheckIosAnalyzer
-    VERSION = '1.0.0'
+    VERSION = '1.1.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fastlane-plugin-dependency_check_ios_analyzer
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Alexey Alter-Pesotskiy
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-05-02 00:00:00.000000000 Z
+date: 2021-05-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: curb