Jacked provides organizations with a more comprehensive look at their application to take calculated actions and create a better security approach. Its primary purpose is to scan vulnerabilities to implement subsequent risk mitigation measures.
This jenkins plugin scans a given target and expose vulnerability.
This jenkins plugin installs jacked binary tool in the job workspace directory and performs scan.
Auto-install & Update Binary Jacked
The plugin will install the "jacked" binary tool. (Windows and Linux Supported)
- Auto-update: If checked, the binary will automatically update when a new release is available.
- Uses Scoop for Windows
- Uses Shell Script for Linux
Provides the following:
- Show a list of packages.
Analyzing BOM: Showing vulnerabilities found and providing recommendations to fix them.- Assessment Result: Pass or Fail based on the selected fail criteria severity type.
- Saves output file on the workspace in every build.
jacked_result_$(JOBNAME)_$(BUILDNUMBER).txt - Saves Stored Values JSON File for Environment Variables.
jackedTmpDir/jacked_file.json
Description: Specified the input on scan field based on the selected scan type.
Option:
Image: Provide the image to be scanned.Directory: Provide the target directory path to be scanned.Tar File: Provide the target tar file path to be scanned.SBOM File: Provide the target Diggity JSON Format SBOM file path to be scanned.
Input: Image name, Directory path, tar file path, or sbom file path.
Description: Select a threshold that will fail the build when equal to or above the severity found in the results.
Option:
- Critical
- High
- Medium
- Low
- Negligible
- Unknown
Usage: Ignore the following package names when scanning. Leave blank if not using.
Example Input Format: dpkg,tar,gzip,...
Usage: Ignore the following CVEs when scanning. Leave blank if not using.
Example Input Format: CVE-2022-24775,CVE-2022-1304,TEMP-0000000-6F6CD4,...
Default value is false / unchecked.
Warning: If the value is checked, it will restrict the plugin from failing the build based on the assessment result.
Default value is false / unchecked.
Warning: If the value is checked, it will skip check database update while scanning.
pipeline {
agent any
stages {
stage('Jacked Scan') {
steps {
script {
jacked scanType: 'image', // Choose Scan Type: image, directory, tar, or sbom.
scanName: 'ubuntu', // Input: Image name, Directory path, tar file path, or sbom file path.
severityType: 'high', // Select a threshold that will fail the build when equal to or above the severity found in the results.
// Severity: critical, high, medium, low, negligible, unknown.
skipFail: false, // Default as false. Skip build to fail based on the assessment.
skipDbUpdate: false, // Default as false. Skip Database Update when scanning.
ignorePackageNames: '', // Ignore Package names when scanning... e.g. input: dpkg,tar,bash,...
ignoreCves: '' // Ignore CVES when scanning... e.g. input: CVE-2022-1271,CVE-2022-3715,CVE-2022-1664,...
}
}
}
}
}
Welcome to this guide on accessing stored values for your environment variable usage. In this document, we will explore how you can retrieve and utilize stored values effectively in your environment variables within your applications or scripts.
Environment variables provide a flexible way to store and manage configuration values that are essential for your applications or scripts. They allow you to separate configuration from code, making it easier to deploy and maintain your software across different environments.
Jenkins is a popular open-source automation server that enables continuous integration and delivery (CI/CD) workflows. It offers various features, including the ability to store and manage environment variables.
One common use case is retrieving stored values from Jenkins and utilizing them as environment variables within your pipeline scripts. Jenkins provides convenient methods to access and utilize these values during the build process.
We'll walk you through an example of reading values from a JSON file stored in Jenkins and using them as environment variables. This can be particularly useful for storing and accessing configuration settings or external dependencies.
Understanding how to access stored values for your environment variable usage is crucial for building robust and configurable applications or scripts. By leveraging tools like Jenkins and following best practices, you can streamline your development process and ensure smooth deployments across different environments.
Now, let's dive into the details and learn how to effectively access stored values in your environment variables!
catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') { // Jacked Scan script.. }
In this script, we have added a catchError() block to ensure that all stages within the pipeline are executed, regardless of failures. By default, when a specific stage fails, the pipeline skips all subsequent stages. However, with the catchError() block in place, this behavior is overridden.
Since we are utilizing a vulnerability scanner, it is expected that the build may fail based on the assessment results. This is important to inform users that vulnerabilities have been detected and need to be addressed.
stage('Jacked Scan') {
steps {
catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') { // Prevents other stages to be skipped when JACKED ASSESSMENT is failed
script {
jacked scanType: 'images', // Choose Scan Type: image, directory, tar, or sbom.
scanName: 'alpine', // Input: Image name, Directory path, tar file path, or sbom file path.
severityType: 'high', // Select a threshold that will fail the build when equal to or above the severity found in the results.
// Severity: critical, high, medium, low, negligible, unknown.
skipFail: false, // Default as false. Skip build to fail based on the assessment.
skipDbUpdate: false, // Default as false. Skip Database Update when scanning.
ignorePackageNames: '', // Ignore Package names when scanning... e.g. input: dpkg,tar,bash,...
ignoreCves: '' // Ignore CVES when scanning... e.g. input: CVE-2022-1271,CVE-2022-3715,CVE-2022-1664,...
}
}
}
}
Once implemented we are now ready to add more stages based on your usage to our pipeline script.
Pipeline Usage Guide: Adding Read JSON File Stage to Access Stored Values for Environment Variable Usage.
In this pipeline script, we have included a stage called "Read JSON" to facilitate the extraction of stored values from a JSON file and utilize them as environment variables. This stage allows you to access multiple values from the JSON file and incorporate them into your pipeline's environment.
By using the readJSON step, we can retrieve various values from the JSON file and assign them to variables. In addition to the "buildStatus" value, we can also extract other key-value pairs such as "jackedAssessment,", "assessmentSummary" "scanType," and "scanName" from the JSON file.
def jackedFilePath = "${env.WORKSPACE}/jackedTmpDir/jacked_file.json"
def json = readJSON file: jackedFilePath
def jackedAssessment = json.jackedAssessment
def assessmentSummary = json.assessmentSummary
def scanType = json.scanType
def scanName = json.scanName
def buildStatus = json.buildStatus
// Optional: Display Value, File Path
echo "Build Status: ${buildStatus}"
echo "File path: ${jackedFilePath}"
// Set the value as a global environment variable
env.BUILD_STATUS = buildStatus
env.jackedAssessment = jackedAssessment
env.assessmentSummary = assessmentSummary
env.scanType = scanType
env.scanName = scanName
Once the values are extracted, we can echo them to provide visibility and confirmation of the retrieved data. Furthermore, these values can be set as global environment variables, allowing you to utilize them across different stages or post-processing actions within your pipeline.
// Set the value as a global environment variable
env.BUILD_STATUS = buildStatus
env.jackedAssessment = jackedAssessment
env.assessmentSummary = assessmentSummary
env.scanType = scanType
env.scanName = scanName
// Optional: Display Value
echo "Build Status: ${buildStatus}"
// Display File Path
def jackedFilePath = "${env.WORKSPACE}/jackedTmpDir/jacked_file.json"
echo "File path: ${jackedFilePath}"
stage('Read JSON') {
steps {
script {
def jackedFilePath = "${env.WORKSPACE}/jackedTmpDir/jacked_file.json"
def json = readJSON file: jackedFilePath
def jackedAssessment = json.jackedAssessment
def assessmentSummary = json.assessmentSummary
def scanType = json.scanType
def scanName = json.scanName
def buildStatus = json.buildStatus
// Optional: Display Value, File Path
echo "Build Status: ${buildStatus}"
echo "File path: ${jackedFilePath}"
// Set the value as a global environment variable
env.BUILD_STATUS = buildStatus
env.jackedAssessment = jackedAssessment
env.assessmentSummary = assessmentSummary
env.scanType = scanType
env.scanName = scanName
}
}
}
With the flexibility provided by the "Read JSON" stage, you can effortlessly access and utilize multiple stored values from a JSON file, empowering you to customize your pipeline's behavior based on the extracted information.
pipeline {
agent any
stages {
stage('Jacked Scan') {
steps {
catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
script {
jacked scanType: 'image', // Choose Scan Type: image, directory, tar, or sbom.
scanName: 'alpine', // Input: Image name, Directory path, tar file path, or sbom file path.
severityType: 'high', // Select a threshold that will fail the build when equal to or above the severity found in the results.
// Severity: critical, high, medium, low, negligible, unknown.
skipFail: false, // Default as false. Skip build to fail based on the assessment.
skipDbUpdate: false, // Default as false. Skip Database Update when scanning.
ignorePackageNames: '', // Ignore Package names when scanning... e.g. input: dpkg,tar,bash,...
ignoreCves: '' // Ignore CVES when scanning... e.g. input: CVE-2022-1271,CVE-2022-3715,CVE-2022-1664,...
}
}
}
}
stage('Read JSON') {
steps {
catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
script {
def jackedFilePath = "${env.WORKSPACE}/jackedTmpDir/jacked_file.json"
def json = readJSON file: jackedFilePath
def jackedAssessment = json.jackedAssessment
def assessmentSummary = json.assessmentSummary
def scanType = json.scanType
def scanName = json.scanName
def buildStatus = json.buildStatus
// Optional: Display Value, File Path
echo "Build Status: ${buildStatus}"
echo "File path: ${jackedFilePath}"
// Set the value as a global environment variable
env.BUILD_STATUS = buildStatus
env.jackedAssessment = jackedAssessment
env.assessmentSummary = assessmentSummary
env.scanType = scanType
env.scanName = scanName
}
}
}
}
}
post {
always {
// Access the global environment variable
echo "jackedAssessment: ${env.jackedAssessment}"
echo "assessmentSummary: ${env.assessmentSummary}"
echo "scanType: ${env.scanType}"
echo "scanName: ${env.scanName}"
echo "Build Status: ${env.BUILD_STATUS}"
}
}
}
Here's a sample of the stored values inside a JSON file named jacked_file.json that is generated inside workspace directory name: jackedTmpDir.
{
"scanName":"ubuntu",
"jackedAssessment":"failed",
"assessmentSummary":"Failed: 6 out of 10 found vulnerabilities failed the assessment",
"scanType":"image",
"buildStatus":"failed"
}
Licensed under MIT, see LICENSE