Has anyone used command line to run fortify? I tryin to incorporate fortify run in my CI build and I dont know how to do it.
6 Answers
At my company, we created a docker image to manage Fortify commands in the CI process.
Basically, we developed a python script to help us keep the scan centralized and then call this image docker in a job at GitlabCI.
As the guys explained, sourceanalyzer is the tool to do the scans and we use the cloudscan tool to connect with the SCC and download the scans and check the status of the analysis.
We also use:
- fortifyclient to upload to * .fpr files
- FPRUtility to merge * .fpr files
- ReportGenerator to make a pdf with the final result.
Currently we use fortify 19.10.
Related