dataliquid :: API Portal Maven Plugin

Maven Plugin to use the API Portal functionality.

License

License

Apache License, Version 2.0
Categories

Categories

Maven Build Tools Data
GroupId

GroupId

com.dataliquid.maven
ArtifactId

ArtifactId

api-portal-maven-plugin
Last Version

Last Version

1.0.1
Release Date

Release Date

Type

Type

maven-plugin
Description

Description

dataliquid :: API Portal Maven Plugin
Maven Plugin to use the API Portal functionality.
Project URL

Project URL

https://www.api-portal.io
Project Organization

Project Organization

dataliquid GmbH
Source Code Management

Source Code Management

https://github.com/dataliquid/distribution-verifier-maven-plugin/tree/master

Download api-portal-maven-plugin

How to add to project

<plugin>
    <groupId>com.dataliquid.maven</groupId>
    <artifactId>api-portal-maven-plugin</artifactId>
    <version>1.0.1</version>
</plugin>

Dependencies

compile (7)

Group / Artifact Type Version
org.apache.maven : maven-plugin-api jar 2.0
org.apache.maven : maven-settings jar 3.0.4
org.apache.maven : maven-core jar 3.3.9
org.codehaus.plexus : plexus-utils jar 3.0.8
org.apache.maven : maven-project jar 2.2.1
com.github.kevinsawicki : http-request jar 6.0
commons-lang : commons-lang jar 2.6

provided (1)

Group / Artifact Type Version
org.apache.maven.plugin-tools : maven-plugin-annotations jar 3.2

test (1)

Group / Artifact Type Version
junit : junit jar 4.11

Project Modules

There are no modules declared in this project.

Intro

The Maven Distribution Verifier Plugin allows verification of .jar, .war, .ear and .zip files. The content is checked against a defined whitelist. This ensures that only the expected artifacts with the respective fingerprint are included in your application distribution.

If there are any discrepancies in the defined hash values or files that are not defined during the verification process, a report is generated. In this way, the software artifact is additionally hardened in the quality assurance process.

Whitelist

The whitelist file whitelist.xml contains file name, path and the MD5 fingerprint.

Attribute Description

path

File path within the Zip file

md5

File expects md5 hash. The attribute is optional. If missing, only checks whether the file exists.

<whitelist>
  <entry path="/Sample.md" />
  <entry md5="193fa5e788a1800a760d1108051c2363" path="/Sample.txt" />
</whitelist>

Report

After verification, all results are summarized in a report. The file report.xml contains information on both successful and faulty checks.

Each file is shown with a status and message.

The status can have the following values:

  • SUCCESS

  • FAILED

<report>
 <entry md5="4114b3e750902c5404ffe4864b3e11b8" path="/Sample.md">
    <result message="Validation passed successfully" status="SUCCESS" />
 </entry>
 <entry md5="193fa5e788a1800a760d1108051c4711" path="/Sample.txt">
    <result message="File found but with a different MD5 Checksum 193fa5e788a1800a760d1108051c2363"
            status="FAILED" />
 </entry>
 <entry md5="193fa5e788a1800a760d1108051c7778" path="/Sample.adoc">
    <result message="Defined file not found" status="FAILED" />
 </entry>
 <entry md5="0430eba9643b5e60e49c055eb16cbf7a" path="/Sample.adoc">
    <result status="FAILED" message="File is not defined in whitelist" />
 </entry>
</report>

Tools

Creating an initial whitelist, the commands find and md5sum can be combined on linux systems. Listing all files with path and MD5 hash in the whitelist structure, use this command:

cd path/to/your/directory
find * -type f -exec md5sum {} \; | awk '{printf "<entry path=\"/%s\" md5=\"%s\" />%s", $2, $1, "\n"}'

The <entry> elements are displayed on the console after the processing has been completed. These can then be transferred to your own whitelist.

<entry path="/Sample.md"   md5="4114b3e750902c5404ffe4864b3e11b8" />
<entry path="/Sample.text" md5="193fa5e788a1800a760d1108051c2363" />
com.dataliquid.maven

dataliquid

Quality first. We build better enterprise software.

Versions

Version
1.0.1