Introduction

ModelOp Center provides the ability to integrate with Veracode to enable automated code scanning of registered models within ModelOp Center

Veracode Integration Setup

Prerequisites

This guide assumes the following prerequisites

• your Veracode username stored in either VERACODE_USERNAMEin your secrets/secrets.jsonor in the Spring property mlc.veracode-task-monitor.username

• your Veracode password stored in either VERACODE_PASSWORDin your secrets/secrets.jsonor in the Spring property mlc.veracode-task-monitor.password

• the Spring property mlc.process.global.veracodeAppid is available and contains your Veracode application id

• the variableVERACODE_BUILD_ID_FROM_JENKINS is set and contains the build id of the Jenkins process that initiated the Veracode build we will be looking for

• a running Veracode process, invoked from Jenkins

Task variables

• APP_ID - Veracode app id

• SANDBOX_ID - Veracode sandbox id

• SANDBOX_NAME - Veracode sandbox name

• VERACODE_BUILD_ID_FROM_JENKINS - the build id of the Jenkins process that initiated the Veracode build

Spring properties

• http.proxyHostis for a proxy host and defaults to null

• http.proxyPortis for a proxy port and defaults to null

• mlc.veracode-task-monitor.poll-rate specifies how often (in milliseconds) to check for Veracode tasks. The default is 5000 milliseconds

Veracode Task

At a high level, we want our Veracode integration to begin shortly after the Veracode process is running, and then the MLC will poll until a summary report is found. To get a summary report the Veracode task

1. Retrieves the task variables from above

2. Using the APP_ID, retrieves a list of sandboxes

3. Finds the sandbox that matches the SANDBOX_ID or SANDBOX_NAME

4. Using the SANDBOX_ID from the matching sandbox, retrieves a list of builds

5. Finds the Veracode build that matches the VERACODE_BUILD_ID_FROM_JENKINS

6. Retrieves the summary report using the id from the matching Veracode build

7. Given a non-null policy compliance status, saves the summary report to the SUMMARY_REPORTfield

Example MLC Integration with Veracode

The Veracode MLC integration occur after the initial Jenkins job has completed and the Veracode job has been invoked. The task will wait until a summary report is found.

For example:

Open

Sample responses

This is a sample response for getting a list of sandboxes

This is a sample response for getting a list of builds

Finally, here is a sample summary report response