One static analysis tool to rule them all.
Codeburner is a tool to help security (and dev!) teams manage the chaos of static code analysis. Sure, you can fire off a bunch of scripts at the end of every CI build... but what do you actually DO with all those results?
Codeburner uses the OWASP pipeline project to run multiple open source and commercial static analysis tools against your code, and provides a unified (and we think rather attractive) interface to sort and act on the issues it finds.
Some key features:
- Fully asynchronous scanning that scales well
- Publish issues to JIRA or GitHub
- Advanced false positive filtering
- Statistics/charts show trends over time
You need, minimally, mysqld and redis-server installed and running.
Clone the repository:
git clone https://github.com/groupon/codeburner
cd codeburner
gem install bundler
bundle install
Create the mysql database:
rake db:setup
You'll probably want to configure a few things before you start anything up. Notably config/database.yml and config/app.yml.
Database configuration is in config/database.yml. The defaults should be fine for development/test, you'll obviously want to configure staging and production as appropriate to your own environment.
Redis is configured in config/application.rb. The defaults should be fine for local development, but you'll probably want to tweak them for a prod/HA deployment.
Github is configured in config/app.yml. For public github, you just need to set api_access_token to one that you generate from 'Account Settings/Personal access tokens' on GitHub.
JIRA authentication is currently username/password, both of which can be configured in config/app.yml. You'll also need to minimally set the host (for api connections) and link_host (a base url for generating clickable links) here.
Mail for burn notifications is configured in config/app.yml. The 'link_host' variable is used when rendering notification e-mails as a base url for clickable links.
For development we recommend the standard WEBrick server with the spring gem for fast iteration:
bundle exec rails s -p 8080
Running in a production environment, codeburner has been tested and works well with both puma and unicorn. While we haven't tested it with anything else, it should play nicely with most standard rack servers.
Codeburner uses sidekiq for asynchronous work. To "do" anything useful (actually scan the code) you must first run:
bundle exec sidekiq ./config/sidekiq.yml
The code for the javascript client can be found in ./client.
The default cap deploy will build the client and pull the results into /public. To do this manually, use the following cap task:
cap frontend:build
If you want to do development work on the frontend, please see the README.md file in the /client directory for more details.
While we're working on a more universal method of handling tools, support for individual scanning tools (that aren't included as ruby gems via pipeline: bundler-audit, brakeman, dawnscanner) currently requires manual installation on your codeburner host.
Install RetireJS as a global node package:
npm install -g retire
NSP is also installed as a node package:
npm install -g nsp
You must have a local MTA (sendmail/postfix/etc) capable of deliverying to external addresses if you want to test e-mail notifications
Codeburner is designed to use fairly standard capistrano based deployment. However, the Capfile we've included is very basic and won't work out of the box. Once you get that configured per your environment, you should be able to do something like...
cap <env> deploy
The default deployment shouldn't start/restart sidekiq on the remote host. You can start it the first time with:
cap <env> sidekiq:start
And if you've changed code that requires it (burn ignition, models, or notification pipeline) run:
cap <env> sidekiq:restart
To trigger a code burn automatically, send it a payload containing a service name, code revision, and repository URL:
curl -H "Content-Type: application/json" -X POST -d '{"service_name":"my_cool_service", "revision":"abcdefg1234567890", "repo_url":"https://github.com/my/repo/url"}' http://localhost:8080/api/burn