Phillip Hoff
5 years ago
18 changed files with 466 additions and 99 deletions
@ -0,0 +1,109 @@ |
|||||
|
Param( |
||||
|
[string] $GuardianCliLocation, |
||||
|
[string] $WorkingDirectory, |
||||
|
[string] $TargetDirectory, |
||||
|
[string] $GdnFolder, |
||||
|
# The list of Guardian tools to configure. For each object in the array: |
||||
|
# - If the item is a [hashtable], it must contain these entries: |
||||
|
# - Name = The tool name as Guardian knows it. |
||||
|
# - Scenario = (Optional) Scenario-specific name for this configuration entry. It must be unique |
||||
|
# among all tool entries with the same Name. |
||||
|
# - Args = (Optional) Array of Guardian tool configuration args, like '@("Target > C:\temp")' |
||||
|
# - If the item is a [string] $v, it is treated as '@{ Name="$v" }' |
||||
|
[object[]] $ToolsList, |
||||
|
[string] $GuardianLoggerLevel='Standard', |
||||
|
# Optional: Additional params to add to any tool using CredScan. |
||||
|
[string[]] $CrScanAdditionalRunConfigParams, |
||||
|
# Optional: Additional params to add to any tool using PoliCheck. |
||||
|
[string[]] $PoliCheckAdditionalRunConfigParams |
||||
|
) |
||||
|
|
||||
|
$ErrorActionPreference = 'Stop' |
||||
|
Set-StrictMode -Version 2.0 |
||||
|
$disableConfigureToolsetImport = $true |
||||
|
$global:LASTEXITCODE = 0 |
||||
|
|
||||
|
try { |
||||
|
# `tools.ps1` checks $ci to perform some actions. Since the SDL |
||||
|
# scripts don't necessarily execute in the same agent that run the |
||||
|
# build.ps1/sh script this variable isn't automatically set. |
||||
|
$ci = $true |
||||
|
. $PSScriptRoot\..\tools.ps1 |
||||
|
|
||||
|
# Normalize tools list: all in [hashtable] form with defined values for each key. |
||||
|
$ToolsList = $ToolsList | |
||||
|
ForEach-Object { |
||||
|
if ($_ -is [string]) { |
||||
|
$_ = @{ Name = $_ } |
||||
|
} |
||||
|
|
||||
|
if (-not ($_['Scenario'])) { $_.Scenario = "" } |
||||
|
if (-not ($_['Args'])) { $_.Args = @() } |
||||
|
$_ |
||||
|
} |
||||
|
|
||||
|
Write-Host "List of tools to configure:" |
||||
|
$ToolsList | ForEach-Object { $_ | Out-String | Write-Host } |
||||
|
|
||||
|
# We store config files in the r directory of .gdn |
||||
|
$gdnConfigPath = Join-Path $GdnFolder 'r' |
||||
|
$ValidPath = Test-Path $GuardianCliLocation |
||||
|
|
||||
|
if ($ValidPath -eq $False) |
||||
|
{ |
||||
|
Write-PipelineTelemetryError -Force -Category 'Sdl' -Message "Invalid Guardian CLI Location." |
||||
|
ExitWithExitCode 1 |
||||
|
} |
||||
|
|
||||
|
foreach ($tool in $ToolsList) { |
||||
|
# Put together the name and scenario to make a unique key. |
||||
|
$toolConfigName = $tool.Name |
||||
|
if ($tool.Scenario) { |
||||
|
$toolConfigName += "_" + $tool.Scenario |
||||
|
} |
||||
|
|
||||
|
Write-Host "=== Configuring $toolConfigName..." |
||||
|
|
||||
|
$gdnConfigFile = Join-Path $gdnConfigPath "$toolConfigName-configure.gdnconfig" |
||||
|
|
||||
|
# For some tools, add default and automatic args. |
||||
|
if ($tool.Name -eq 'credscan') { |
||||
|
if ($targetDirectory) { |
||||
|
$tool.Args += "TargetDirectory < $TargetDirectory" |
||||
|
} |
||||
|
$tool.Args += "OutputType < pre" |
||||
|
$tool.Args += $CrScanAdditionalRunConfigParams |
||||
|
} elseif ($tool.Name -eq 'policheck') { |
||||
|
if ($targetDirectory) { |
||||
|
$tool.Args += "Target < $TargetDirectory" |
||||
|
} |
||||
|
$tool.Args += $PoliCheckAdditionalRunConfigParams |
||||
|
} |
||||
|
|
||||
|
# Create variable pointing to the args array directly so we can use splat syntax later. |
||||
|
$toolArgs = $tool.Args |
||||
|
|
||||
|
# Configure the tool. If args array is provided or the current tool has some default arguments |
||||
|
# defined, add "--args" and splat each element on the end. Arg format is "{Arg id} < {Value}", |
||||
|
# one per parameter. Doc page for "guardian configure": |
||||
|
# https://dev.azure.com/securitytools/SecurityIntegration/_wiki/wikis/Guardian/1395/configure |
||||
|
Exec-BlockVerbosely { |
||||
|
& $GuardianCliLocation configure ` |
||||
|
--working-directory $WorkingDirectory ` |
||||
|
--tool $tool.Name ` |
||||
|
--output-path $gdnConfigFile ` |
||||
|
--logger-level $GuardianLoggerLevel ` |
||||
|
--noninteractive ` |
||||
|
--force ` |
||||
|
$(if ($toolArgs) { "--args" }) @toolArgs |
||||
|
Exit-IfNZEC "Sdl" |
||||
|
} |
||||
|
|
||||
|
Write-Host "Created '$toolConfigName' configuration file: $gdnConfigFile" |
||||
|
} |
||||
|
} |
||||
|
catch { |
||||
|
Write-Host $_.ScriptStackTrace |
||||
|
Write-PipelineTelemetryError -Force -Category 'Sdl' -Message $_ |
||||
|
ExitWithExitCode 1 |
||||
|
} |
||||
@ -0,0 +1,63 @@ |
|||||
|
# This script looks for each archive file in a directory and extracts it into the target directory. |
||||
|
# For example, the file "$InputPath/bin.tar.gz" extracts to "$ExtractPath/bin.tar.gz.extracted/**". |
||||
|
# Uses the "tar" utility added to Windows 10 / Windows 2019 that supports tar.gz and zip. |
||||
|
param( |
||||
|
# Full path to directory where archives are stored. |
||||
|
[Parameter(Mandatory=$true)][string] $InputPath, |
||||
|
# Full path to directory to extract archives into. May be the same as $InputPath. |
||||
|
[Parameter(Mandatory=$true)][string] $ExtractPath |
||||
|
) |
||||
|
|
||||
|
$ErrorActionPreference = 'Stop' |
||||
|
Set-StrictMode -Version 2.0 |
||||
|
|
||||
|
$disableConfigureToolsetImport = $true |
||||
|
|
||||
|
try { |
||||
|
# `tools.ps1` checks $ci to perform some actions. Since the SDL |
||||
|
# scripts don't necessarily execute in the same agent that run the |
||||
|
# build.ps1/sh script this variable isn't automatically set. |
||||
|
$ci = $true |
||||
|
. $PSScriptRoot\..\tools.ps1 |
||||
|
|
||||
|
Measure-Command { |
||||
|
$jobs = @() |
||||
|
|
||||
|
# Find archive files for non-Windows and Windows builds. |
||||
|
$archiveFiles = @( |
||||
|
Get-ChildItem (Join-Path $InputPath "*.tar.gz") |
||||
|
Get-ChildItem (Join-Path $InputPath "*.zip") |
||||
|
) |
||||
|
|
||||
|
foreach ($targzFile in $archiveFiles) { |
||||
|
$jobs += Start-Job -ScriptBlock { |
||||
|
$file = $using:targzFile |
||||
|
$fileName = [System.IO.Path]::GetFileName($file) |
||||
|
$extractDir = Join-Path $using:ExtractPath "$fileName.extracted" |
||||
|
|
||||
|
New-Item $extractDir -ItemType Directory -Force | Out-Null |
||||
|
|
||||
|
Write-Host "Extracting '$file' to '$extractDir'..." |
||||
|
|
||||
|
# Pipe errors to stdout to prevent PowerShell detecting them and quitting the job early. |
||||
|
# This type of quit skips the catch, so we wouldn't be able to tell which file triggered the |
||||
|
# error. Save output so it can be stored in the exception string along with context. |
||||
|
$output = tar -xf $file -C $extractDir 2>&1 |
||||
|
# Handle NZEC manually rather than using Exit-IfNZEC: we are in a background job, so we |
||||
|
# don't have access to the outer scope. |
||||
|
if ($LASTEXITCODE -ne 0) { |
||||
|
throw "Error extracting '$file': non-zero exit code ($LASTEXITCODE). Output: '$output'" |
||||
|
} |
||||
|
|
||||
|
Write-Host "Extracted to $extractDir" |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
Receive-Job $jobs -Wait |
||||
|
} |
||||
|
} |
||||
|
catch { |
||||
|
Write-Host $_ |
||||
|
Write-PipelineTelemetryError -Force -Category 'Sdl' -Message $_ |
||||
|
ExitWithExitCode 1 |
||||
|
} |
||||
@ -0,0 +1,20 @@ |
|||||
|
// Licensed to the .NET Foundation under one or more agreements.
|
||||
|
// The .NET Foundation licenses this file to you under the MIT license.
|
||||
|
// See the LICENSE file in the project root for more information.
|
||||
|
|
||||
|
using System.Collections.Generic; |
||||
|
|
||||
|
namespace Microsoft.Tye |
||||
|
{ |
||||
|
public abstract class LaunchedServiceBuilder : ServiceBuilder |
||||
|
{ |
||||
|
public LaunchedServiceBuilder(string name) |
||||
|
: base(name) |
||||
|
{ |
||||
|
} |
||||
|
|
||||
|
public List<EnvironmentVariableBuilder> EnvironmentVariables { get; } = new List<EnvironmentVariableBuilder>(); |
||||
|
|
||||
|
public int Replicas { get; set; } = 1; |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue