This is the main component of the secureCodeBox it's a Camunda BPMN engine, which allows the engineer to build the whole scan process as a BPMN model. This component also provides the main web UI: The secureCodeBox control center. In this UI you can see the available scan process definitions as BPMN diagrams, start them (Tasklist), and manually review the results. Furthermore, the core provides a possibility to listen on webhooks and integrate the exposed process API, allowing us to trigger the scan processes by a continuous integration component, such as Jenkins, in our example, or any other which can deal with webhooks.
Important note: The secureCodeBox is no simple one-button-click-solution! You must have a deep understanding of security and how to configure the scanners. Furthermore, an understanding ot the scan results and how to interpret them is also necessary.
Further Documentation:
To configure the SCB engine specify the following environment variables:
| Environment Variable | Description | Example Value |
|---|---|---|
| SECURECODEBOX_DEFAULT_TARGET_NAME | Default target identifier | BodgeIT Public Host |
| SECURECODEBOX_DEFAULT_TARGET_LOCATION | Default target hostname/ip address | bodgeit |
| SECURECODEBOX_DEFAULT_TARGET_URI | Default target URI/URL | http://bodgeit:8080/bodgeit |
| SECURECODEBOX_DEFAULT_CONTEXT | Default business context | BodgeIT |
| SECURECODEBOX_USER_SCANNER | Default user for scanner services | default-scanner |
| SECURECODEBOX_USER_SCANNER_PW | Default password for scanner services | AStrongPassword-NotThisOne! |
Additionally all properties defined in scb-engine/src/main/resources/application.yaml can be overwritten via environment variables. This allows you to e.g. enable https using:
| Environment Variable | Description | Example Value |
|---|---|---|
| SERVER_PORT | Defines the server port | 8443 |
| SERVER_SSL_ENABLED | Enables http over ssl | true |
| SERVER_SSL_KEY_STORE_PASSWORD | Password to the java keystore | AStrongPassword-NotThisOne! |
- Clone the repository
- You might need to install some dependencies
java,maven - Run locally
mvn spring-boot:run -Pdev
To run the testsuite run:
mvn test
To build the docker container run:
docker build -t CONTAINER_NAME .
Well boring yes - but please read our guidelines and naming standards.