Java

GitLab security products have been constantly improving support for different build tools and programming languages. My recent contribution to License compliance allows now to inject commands SETUP_CMD environment variable to the core to bypass the package manager auto-detection and make use of the ./gradlew Gradle wrapper script. For example: include: - template: Security/License-Scanning.gitlab-ci.yml variables: SETUP_CMD: sh my-custom-install-script.sh In this example, my-custom-install-script.sh is a shell script at the root directory of your project.

On macOS you can use /usr/libexec/java_home command to control your used Java version. As a lot of applications and/or projects still require Java 1.8 or you might want to use an alternative JDK/JRE let’s look into managing those different versions. $ /usr/libexec/java_home -h Usage: java_home [options...] Returns the path to a Java home directory from the current user's settings. Options: [-v/--version <version>] Filter Java versions in the "JVMVersion" form 1.X(+ or *). [-a/--arch <architecture>] Filter JVMs matching architecture (i386, x86_64, etc). [-d/--datamodel <datamodel>] Filter JVMs capable of -d32 or -d64 [-t/--task <task>] Use the JVM list for a specific task (Applets, WebStart, BundledApp, JNI, or CommandLine) [-F/--failfast] Fail when filters return no JVMs, do not continue with default. [ --exec <command> ...] Execute the $JAVA_HOME/bin/<command> with the remaining arguments. [-R/--request] Request installation of a Java Runtime if not installed. [-X/--xml] Print full JVM list and additional data as XML plist. [-V/--verbose] Print full JVM list with architectures. [-h/--help] This usage information. Manual installation For this post I’ve decided to use AdoptOpenJDK as it’s actively maintained. ...

If built-in License Management functionality does not support the programming language requirements you have, you can customize the License Management docker image. This guide shows you how to use License Management with OpenJDK 11 or later. License Management definition License Management helps you find what licenses your project uses in its dependencies and decide for each of then whether to allow it or forbid it. License Compliance report under pipelines ...

If built-in Static Application Security Testing functionality does not support the programming language requirements you have, you can customize the analyzer docker images in [GitLab]’s sast pipeline job. This guide shows you how to use SAST with OpenJDK 11 or later. SAST definition Static Application Security Testing provides you information if your application is vulnerable by using an external library in a specific version which is known to be vulnerable or your code has a potentially dangerous attribute in a class, or unsafe code that can lead to unintended code execution. Project Security Dashboard ...