Skip to content

Commit befbc38

Browse files
RichardSlaterRichardSlater
authored
Merge pull request #315 from Ensono/chore/deps-consolidate-remaining
chore(deps): fix NVD API Key & consolidate dependency updates
2 parents b7c432c + c713ede commit befbc38

2 files changed

Lines changed: 144 additions & 13 deletions

File tree

‎docs/NVD.md‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# NVD API Key Configuration
2+
3+
## Problem
4+
5+
OWASP dependency scans run **15-60+ minutes without an NVD API key**, vs **2-5 minutes with one**.
6+
7+
Build warning:
8+
9+
```
10+
[WARNING] An NVD API Key was not provided - it is highly recommended to use
11+
an NVD API key as the update can take a VERY long time without an API Key
12+
```
13+
14+
## Solution
15+
16+
### 1. Request NVD API Key
17+
18+
Visit: https://nvd.nist.gov/developers/request-an-api-key (free, ~5 min)
19+
20+
### 2. Add to Azure DevOps Library
21+
22+
1. **Pipelines → Library**
23+
2. Find variable group: `stacks-java-module-parent`
24+
3. Add secret:
25+
- **Name**: `VULNERABILITY_SCAN_API_KEY`
26+
- **Value**: `<your-nvd-api-key>`
27+
- **Mark as secret**: ✅
28+
29+
### 3. Verify
30+
31+
Queue a new build. Look for in logs:
32+
33+
```
34+
[INFO] Using NVD API Key to download latest vulnerability data ✅
35+
```
36+
37+
## How It Works
38+
39+
```
40+
Azure DevOps Secret (VULNERABILITY_SCAN_API_KEY)
41+
↓
42+
Pipeline YAML (azure-pipelines-javaspring-deploy.yml)
43+
↓
44+
Variable Definition (azuredevops-vars.yml)
45+
↓
46+
Build Template (stacks-pipeline-templates)
47+
↓
48+
Environment Variable (NVD_API_KEY)
49+
↓
50+
Maven pom.xml
51+
↓
52+
OWASP Plugin → NVD API
53+
```
54+
55+
## Configuration Files
56+
57+
| File | Line | Purpose | Status |
58+
| --------------------------------------- | ------- | ------------------------------------------- | ---------- |
59+
| `pom.xml` | 302 | `<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>` | ✅ Ready |
60+
| `azure-pipelines-javaspring-deploy.yml` | 50 | Load variable group | ✅ Ready |
61+
| `azure-pipelines-javaspring-deploy.yml` | 88 | Pass to template | ✅ Ready |
62+
| `azuredevops-vars.yml` | 104-106 | Map to secret | ✅ Ready |
63+
| Azure DevOps Library | — | **NEEDS SETUP** | ❌ Missing |
64+
65+
## Local Development
66+
67+
Run security scans locally with API key:
68+
69+
```bash
70+
# Option 1: Environment Variable
71+
export NVD_API_KEY="your-api-key"
72+
./mvnw -P owasp-dependency-check clean verify
73+
74+
# Option 2: Maven Property
75+
./mvnw -P owasp-dependency-check clean verify -Dnvd.api.key=your-api-key
76+
77+
# Option 3: Maven Settings
78+
# Add to ~/.m2/settings.xml: <nvd.api.key>your-api-key</nvd.api.key>
79+
```
80+
81+
## Troubleshooting
82+
83+
### Still Seeing Warning After Setup?
84+
85+
1. Verify variable group name: must be **exactly** `stacks-java-module-parent`
86+
2. Verify secret name: must be **exactly** `VULNERABILITY_SCAN_API_KEY`
87+
3. Queue a new build (first build with secret may need explicit trigger)
88+
4. Wait 1-2 builds for Azure DevOps to propagate
89+
90+
### API Key Not Working?
91+
92+
1. Verify format: `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx` (valid UUID)
93+
2. Request new key: https://nvd.nist.gov/developers/request-an-api-key (old keys may expire)
94+
3. Check network: Build agent must reach `https://services.nvd.nist.gov/`
95+
96+
### Rate Limiting?
97+
98+
NVD API has rate limits. If you see rate limit errors, wait a few minutes and retry.
99+
100+
## Performance Impact
101+
102+
| Scenario | Scan Time |
103+
| --------------- | ----------------- |
104+
| Without API Key | 15-60+ min |
105+
| With API Key | 2-5 min |
106+
| **Speedup** | **10-50x faster** |
107+
108+
## Security
109+
110+
✅ **Best Practices**:
111+
112+
- Secret stored encrypted in Azure DevOps Library
113+
- Automatically masked in build logs
114+
- Not stored in source code
115+
- Only accessible to authorized pipelines
116+
117+
⚠️ **Never**:
118+
119+
- Commit API key to Git
120+
- Put in plain text YAML
121+
- Log or print in builds
122+
- Share across organizations
123+
124+
## References
125+
126+
- [NVD API](https://nvd.nist.gov/developers/start-here)
127+
- [OWASP Dependency-Check](https://jeremylong.github.io/DependencyCheck_Plugin/)
128+
- [Azure DevOps Library](https://docs.microsoft.com/en-us/azure/devops/pipelines/library/)
129+
- [Azure DevOps Secret Variables](https://docs.microsoft.com/en-us/azure/devops/pipelines/build/variables)

‎pom.xml‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -39,25 +39,25 @@
3939

4040
<properties>
4141
<!-- Dependency versions definitions-->
42-
<lombok.version>1.18.34</lombok.version>
42+
<lombok.version>1.18.42</lombok.version>
4343
<auth0-spring-security-api.version>1.5.3</auth0-spring-security-api.version>
44-
<equals-verifier.version>3.19.4</equals-verifier.version>
44+
<equals-verifier.version>4.2.1</equals-verifier.version>
4545
<hamcrest.version>3.0</hamcrest.version>
4646
<fmt-maven-plugin.version>2.13</fmt-maven-plugin.version>
47-
<io-projectreactor-netty.version>1.1.22</io-projectreactor-netty.version>
47+
<io-projectreactor-netty.version>1.2.11</io-projectreactor-netty.version>
4848
<jackson.version>2.20.0</jackson.version>
4949
<jacoco.version>0.8.12</jacoco.version>
50-
<junit-jupiter.version>5.11.2</junit-jupiter.version>
51-
<mockito.version>5.14.1</mockito.version>
50+
<junit-jupiter.version>6.0.1</junit-jupiter.version>
51+
<mockito.version>5.20.0</mockito.version>
5252
<pitest.version>1.17.0</pitest.version>
5353
<pitest-junit5-plugin.version>1.2.3</pitest-junit5-plugin.version>
5454
<puppycrawl-tools-checkstyle.version>12.1.1</puppycrawl-tools-checkstyle.version>
5555
<spotbugs-maven-plugin.version>4.9.8.1</spotbugs-maven-plugin.version>
56-
<spotbugs.version>4.8.6</spotbugs.version>
57-
<assertj-core.version>3.26.3</assertj-core.version>
56+
<spotbugs.version>4.9.8</spotbugs.version>
57+
<assertj-core.version>3.27.6</assertj-core.version>
5858
<netty.version>4.1.125.Final</netty.version>
59-
<logback.version>1.5.13</logback.version>
60-
<projectreactor.version>2023.0.9</projectreactor.version>
59+
<logback.version>1.5.20</logback.version>
60+
<projectreactor.version>2024.0.11</projectreactor.version>
6161
<org.mapstruct.version>1.6.3</org.mapstruct.version>
6262
<org.mapstruct.binding.version>0.2.0</org.mapstruct.binding.version>
6363
<oauth2-oidc-sdk.version>11.30</oauth2-oidc-sdk.version>
@@ -69,15 +69,15 @@
6969
<java.version>17</java.version>
7070

7171
<!-- https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327 -->
72-
<com.google.code.gson-version>2.11.0</com.google.code.gson-version>
72+
<com.google.code.gson-version>2.13.2</com.google.code.gson-version>
7373

7474
<!-- Set the encoding to UTF-8 -->
7575
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
7676
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
7777

7878
<!-- Maven plugins -->
7979
<maven.compiler.release>17</maven.compiler.release>
80-
<maven-checkstyle-plugin.version>3.5.0</maven-checkstyle-plugin.version>
80+
<maven-checkstyle-plugin.version>3.6.0</maven-checkstyle-plugin.version>
8181
<maven-compiler-plugin.version>3.13.0</maven-compiler-plugin.version>
8282
<maven-surefire-phase>test</maven-surefire-phase>
8383
<maven-surefire-plugin.version>3.5.4</maven-surefire-plugin.version>
@@ -88,6 +88,8 @@
8888
<maven-site-plugin.version>3.21.0</maven-site-plugin.version>
8989
<maven-failsafe-plugin.version>3.5.4</maven-failsafe-plugin.version>
9090
<maven-central-publishing-plugin.version>0.6.0</maven-central-publishing-plugin.version>
91+
<!-- Default NVD API key source; can be overridden via -DnvdApiKey or -Dnvd.api.key -->
92+
<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
9193
</properties>
9294

9395
<!-- Dependencies shared by ALL modules-->
@@ -296,10 +298,10 @@
296298
<configuration>
297299
<!-- NVD API Key can be provided via:
298300
1. Environment variable: NVD_API_KEY
299-
2. Maven property: -Dnvd.api.key=your-key
301+
2. Maven property: -DnvdApiKey=your-key or -Dnvd.api.key=your-key
300302
3. Maven settings.xml: <nvd.api.key>your-key</nvd.api.key>
301303
-->
302-
<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
304+
<nvdApiKey>${nvdApiKey}</nvdApiKey>
303305
</configuration>
304306
</plugin>
305307
</plugins>

0 commit comments

Comments
 (0)