Kévin Chalet
4 years ago
24 changed files with 635 additions and 121 deletions
@ -0,0 +1,109 @@ |
|||
Param( |
|||
[string] $GuardianCliLocation, |
|||
[string] $WorkingDirectory, |
|||
[string] $TargetDirectory, |
|||
[string] $GdnFolder, |
|||
# The list of Guardian tools to configure. For each object in the array: |
|||
# - If the item is a [hashtable], it must contain these entries: |
|||
# - Name = The tool name as Guardian knows it. |
|||
# - Scenario = (Optional) Scenario-specific name for this configuration entry. It must be unique |
|||
# among all tool entries with the same Name. |
|||
# - Args = (Optional) Array of Guardian tool configuration args, like '@("Target > C:\temp")' |
|||
# - If the item is a [string] $v, it is treated as '@{ Name="$v" }' |
|||
[object[]] $ToolsList, |
|||
[string] $GuardianLoggerLevel='Standard', |
|||
# Optional: Additional params to add to any tool using CredScan. |
|||
[string[]] $CrScanAdditionalRunConfigParams, |
|||
# Optional: Additional params to add to any tool using PoliCheck. |
|||
[string[]] $PoliCheckAdditionalRunConfigParams |
|||
) |
|||
|
|||
$ErrorActionPreference = 'Stop' |
|||
Set-StrictMode -Version 2.0 |
|||
$disableConfigureToolsetImport = $true |
|||
$global:LASTEXITCODE = 0 |
|||
|
|||
try { |
|||
# `tools.ps1` checks $ci to perform some actions. Since the SDL |
|||
# scripts don't necessarily execute in the same agent that run the |
|||
# build.ps1/sh script this variable isn't automatically set. |
|||
$ci = $true |
|||
. $PSScriptRoot\..\tools.ps1 |
|||
|
|||
# Normalize tools list: all in [hashtable] form with defined values for each key. |
|||
$ToolsList = $ToolsList | |
|||
ForEach-Object { |
|||
if ($_ -is [string]) { |
|||
$_ = @{ Name = $_ } |
|||
} |
|||
|
|||
if (-not ($_['Scenario'])) { $_.Scenario = "" } |
|||
if (-not ($_['Args'])) { $_.Args = @() } |
|||
$_ |
|||
} |
|||
|
|||
Write-Host "List of tools to configure:" |
|||
$ToolsList | ForEach-Object { $_ | Out-String | Write-Host } |
|||
|
|||
# We store config files in the r directory of .gdn |
|||
$gdnConfigPath = Join-Path $GdnFolder 'r' |
|||
$ValidPath = Test-Path $GuardianCliLocation |
|||
|
|||
if ($ValidPath -eq $False) |
|||
{ |
|||
Write-PipelineTelemetryError -Force -Category 'Sdl' -Message "Invalid Guardian CLI Location." |
|||
ExitWithExitCode 1 |
|||
} |
|||
|
|||
foreach ($tool in $ToolsList) { |
|||
# Put together the name and scenario to make a unique key. |
|||
$toolConfigName = $tool.Name |
|||
if ($tool.Scenario) { |
|||
$toolConfigName += "_" + $tool.Scenario |
|||
} |
|||
|
|||
Write-Host "=== Configuring $toolConfigName..." |
|||
|
|||
$gdnConfigFile = Join-Path $gdnConfigPath "$toolConfigName-configure.gdnconfig" |
|||
|
|||
# For some tools, add default and automatic args. |
|||
if ($tool.Name -eq 'credscan') { |
|||
if ($targetDirectory) { |
|||
$tool.Args += "TargetDirectory < $TargetDirectory" |
|||
} |
|||
$tool.Args += "OutputType < pre" |
|||
$tool.Args += $CrScanAdditionalRunConfigParams |
|||
} elseif ($tool.Name -eq 'policheck') { |
|||
if ($targetDirectory) { |
|||
$tool.Args += "Target < $TargetDirectory" |
|||
} |
|||
$tool.Args += $PoliCheckAdditionalRunConfigParams |
|||
} |
|||
|
|||
# Create variable pointing to the args array directly so we can use splat syntax later. |
|||
$toolArgs = $tool.Args |
|||
|
|||
# Configure the tool. If args array is provided or the current tool has some default arguments |
|||
# defined, add "--args" and splat each element on the end. Arg format is "{Arg id} < {Value}", |
|||
# one per parameter. Doc page for "guardian configure": |
|||
# https://dev.azure.com/securitytools/SecurityIntegration/_wiki/wikis/Guardian/1395/configure |
|||
Exec-BlockVerbosely { |
|||
& $GuardianCliLocation configure ` |
|||
--working-directory $WorkingDirectory ` |
|||
--tool $tool.Name ` |
|||
--output-path $gdnConfigFile ` |
|||
--logger-level $GuardianLoggerLevel ` |
|||
--noninteractive ` |
|||
--force ` |
|||
$(if ($toolArgs) { "--args" }) @toolArgs |
|||
Exit-IfNZEC "Sdl" |
|||
} |
|||
|
|||
Write-Host "Created '$toolConfigName' configuration file: $gdnConfigFile" |
|||
} |
|||
} |
|||
catch { |
|||
Write-Host $_.ScriptStackTrace |
|||
Write-PipelineTelemetryError -Force -Category 'Sdl' -Message $_ |
|||
ExitWithExitCode 1 |
|||
} |
|||
@ -0,0 +1,63 @@ |
|||
# This script looks for each archive file in a directory and extracts it into the target directory. |
|||
# For example, the file "$InputPath/bin.tar.gz" extracts to "$ExtractPath/bin.tar.gz.extracted/**". |
|||
# Uses the "tar" utility added to Windows 10 / Windows 2019 that supports tar.gz and zip. |
|||
param( |
|||
# Full path to directory where archives are stored. |
|||
[Parameter(Mandatory=$true)][string] $InputPath, |
|||
# Full path to directory to extract archives into. May be the same as $InputPath. |
|||
[Parameter(Mandatory=$true)][string] $ExtractPath |
|||
) |
|||
|
|||
$ErrorActionPreference = 'Stop' |
|||
Set-StrictMode -Version 2.0 |
|||
|
|||
$disableConfigureToolsetImport = $true |
|||
|
|||
try { |
|||
# `tools.ps1` checks $ci to perform some actions. Since the SDL |
|||
# scripts don't necessarily execute in the same agent that run the |
|||
# build.ps1/sh script this variable isn't automatically set. |
|||
$ci = $true |
|||
. $PSScriptRoot\..\tools.ps1 |
|||
|
|||
Measure-Command { |
|||
$jobs = @() |
|||
|
|||
# Find archive files for non-Windows and Windows builds. |
|||
$archiveFiles = @( |
|||
Get-ChildItem (Join-Path $InputPath "*.tar.gz") |
|||
Get-ChildItem (Join-Path $InputPath "*.zip") |
|||
) |
|||
|
|||
foreach ($targzFile in $archiveFiles) { |
|||
$jobs += Start-Job -ScriptBlock { |
|||
$file = $using:targzFile |
|||
$fileName = [System.IO.Path]::GetFileName($file) |
|||
$extractDir = Join-Path $using:ExtractPath "$fileName.extracted" |
|||
|
|||
New-Item $extractDir -ItemType Directory -Force | Out-Null |
|||
|
|||
Write-Host "Extracting '$file' to '$extractDir'..." |
|||
|
|||
# Pipe errors to stdout to prevent PowerShell detecting them and quitting the job early. |
|||
# This type of quit skips the catch, so we wouldn't be able to tell which file triggered the |
|||
# error. Save output so it can be stored in the exception string along with context. |
|||
$output = tar -xf $file -C $extractDir 2>&1 |
|||
# Handle NZEC manually rather than using Exit-IfNZEC: we are in a background job, so we |
|||
# don't have access to the outer scope. |
|||
if ($LASTEXITCODE -ne 0) { |
|||
throw "Error extracting '$file': non-zero exit code ($LASTEXITCODE). Output: '$output'" |
|||
} |
|||
|
|||
Write-Host "Extracted to $extractDir" |
|||
} |
|||
} |
|||
|
|||
Receive-Job $jobs -Wait |
|||
} |
|||
} |
|||
catch { |
|||
Write-Host $_ |
|||
Write-PipelineTelemetryError -Force -Category 'Sdl' -Message $_ |
|||
ExitWithExitCode 1 |
|||
} |
|||
Loading…
Reference in new issue