fastlane-plugin-dependency_check_ios_analyzer 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ef35dee5ad3ab22fd56bfaf812d32cd3583eafaa89774396d564a62f6631230
-  data.tar.gz: c44a3437fe94b288b9ea0cbf8dce854a5e12b7ee3c23a197a6288be659a81ab1
+  metadata.gz: 7558dd5b5b9ea0f549e3db5b52b55b7e92f2a09f416c0c8d887af72fbf8ca957
+  data.tar.gz: 3dc1036d2ac5c6aaeb6190e4b2d9f15fd747ff3e716e21248aba0228e30d3ff4
 SHA512:
-  metadata.gz: e9a8999284bec6d083ac6fc8bf2d77ac5b55b8edbf5cadfd6ce6a43b4ab6cd105c24d7820294bfc37ec768d364562095fa1e87ddbcc6a39aaf88133c0eb93050
-  data.tar.gz: 59dc152c71bc7fe5b6aa00687cfd60dd7fee57ee5370243d982ca5639dffa9e62f5877b9b213612632d748e2e4108c0ffcb3a02594fa750fab38f3e5e3fdee4c
+  metadata.gz: af7f6ea2260834ae295d95263fae7735daafd909592fc78d561f1cf79f544d7e1f700bec73d781a9d1285f1abc16c123554a5d5824e3ee9a4aa68c54b5e3c9b7
+  data.tar.gz: 1000a9c5781c6a19d25f0c1d86f82d0cd9f2b7464d1c7813cbc3d78e9b588686abcb4ccebfb29e01cc55b006a48d47e91db1cbb86d4baa552bcd882dca916a8a

data/README.md

@@ -20,8 +20,7 @@ This analyzer is considered experimental. While it may be useful and provide val
 | `project_name` | The project's name | `DependencyCheck` |
 | `output_directory` | The directory in which all reports will be stored | `dependency-check` |
 | `output_types` | Comma separated list of the output types (e.g. `html`, `xml`, `csv`, `json`, `junit`, `sarif`, `all`) | `sarif` |
-| `cli_version` | Overwrite the version of `DependencyCheck` analyzer | `6.1.6` |
-| `verify_integrity` | Verify the cryptographic integrity of the tool before starting an analysis | `false` |
+| `cli_version` | Overwrite the version of `DependencyCheck` analyzer | `6.2.2` |
 | `verbose` | The file path to write verbose logging information | |
 | `fail_on_cvss` | Specifies if the build should be failed if a CVSS score above a specified level is identified. Since the CVSS scores are 0-10, by default the build will never fail | `11` |
 | `junit_fail_on_cvss` | Specifies the CVSS score that is considered a failure when generating the junit report | `0` |

data/lib/fastlane/plugin/dependency_check_ios_analyzer/actions/dependency_check_ios_analyzer_action.rb

@@ -114,13 +114,6 @@ module Fastlane
             is_string: true,
             type: String
           ),
-          FastlaneCore::ConfigItem.new(
-            key: :verify_integrity,
-            description: 'Verify the cryptographic integrity of the tool before starting an analysis',
-            optional: true,
-            is_string: false,
-            type: Boolean
-          ),
           FastlaneCore::ConfigItem.new(
             key: :verbose,
             description: 'The file path to write verbose logging information',

data/lib/fastlane/plugin/dependency_check_ios_analyzer/helper/configuration_helper.rb

@@ -10,7 +10,7 @@ module Fastlane
       def self.install(params)
         repo = 'https://github.com/jeremylong/DependencyCheck'
         name = 'dependency-check'
-        version = params[:cli_version] ? params[:cli_version] : '6.1.6'
+        version = params[:cli_version] ? params[:cli_version] : '6.2.2'
         base_url = "#{repo}/releases/download/v#{version}/#{name}-#{version}-release"
         bin_path = "#{params[:output_directory]}/#{name}/bin/#{name}.sh"
         zip_path = "#{params[:output_directory]}/#{name}.zip"
@@ -25,10 +25,6 @@ module Fastlane
             File.open(zip_path, 'w+') { |f| f.write(curl.body_str) }
           end
 
-          if params[:verify_integrity]
-            verify_cryptographic_integrity(zip_path: zip_path, base_url: base_url)
-          end
-
           unzip(file: zip_path, params: params)
 
           FileUtils.rm_rf(zip_path)
@@ -63,26 +59,6 @@ module Fastlane
           end
         end
       end
-
-      def self.verify_cryptographic_integrity(zip_path:, base_url:)
-        asc_url = "#{base_url}.zip.asc"
-        UI.message("🚀 Downloading associated GPG signature file: #{asc_url}")
-        curl = Curl.get(asc_url) { |curl| curl.follow_location = true }
-
-        asc_path = "#{zip_path}.asc"
-        File.open(asc_path, 'w+') { |f| f.write(curl.body_str) }
-
-        # https://jeremylong.github.io/DependencyCheck/dependency-check-cli/
-        gpg_key = 'F9514E84AE3708288374BBBE097586CFEA37F9A6'
-
-        UI.message("🕵️  Verifying the cryptographic integrity")
-        # Import the GPG key used to sign all DependencyCheck releases
-        Actions.sh("gpg --keyserver hkp://keys.gnupg.net --recv-keys #{gpg_key}")
-        # Verify the cryptographic integrity
-        Actions.sh("gpg --verify #{asc_path}")
-
-        FileUtils.rm_rf(asc_path)
-      end
     end
   end
 end

data/lib/fastlane/plugin/dependency_check_ios_analyzer/version.rb

@@ -1,5 +1,5 @@
 module Fastlane
   module DependencyCheckIosAnalyzer
-    VERSION = '1.1.0'
+    VERSION = '1.1.1'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fastlane-plugin-dependency_check_ios_analyzer
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Alexey Alter-Pesotskiy
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-05-21 00:00:00.000000000 Z
+date: 2021-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: curb