dataliquid :: API Portal Maven Plugin

Maven Plugin to use the API Portal functionality.

License	Apache License, Version 2.0
Categories	Maven Build Tools Data
GroupId	com.dataliquid.maven
ArtifactId	api-portal-maven-plugin
Last Version	1.0.1
Release Date	Nov 17, 2019
Type	maven-plugin
Description	dataliquid :: API Portal Maven Plugin Maven Plugin to use the API Portal functionality.
Project URL	https://www.api-portal.io
Project Organization	dataliquid GmbH
Source Code Management	https://github.com/dataliquid/distribution-verifier-maven-plugin/tree/master

Download api-portal-maven-plugin

Filename	Size
api-portal-maven-plugin-1.0.1.pom
api-portal-maven-plugin-1.0.1.jar	16 KB
api-portal-maven-plugin-1.0.1-sources.jar	7 KB

How to add to project

Apache Maven

<plugin>
    <groupId>com.dataliquid.maven</groupId>
    <artifactId>api-portal-maven-plugin</artifactId>
    <version>1.0.1</version>
</plugin>

Dependencies

compile (7)

Group / Artifact	Type	Version
org.apache.maven : maven-plugin-api	jar	2.0
org.apache.maven : maven-settings	jar	3.0.4
org.apache.maven : maven-core	jar	3.3.9
org.codehaus.plexus : plexus-utils	jar	3.0.8
org.apache.maven : maven-project	jar	2.2.1
com.github.kevinsawicki : http-request	jar	6.0
commons-lang : commons-lang	jar	2.6

provided (1)

Group / Artifact	Type	Version
org.apache.maven.plugin-tools : maven-plugin-annotations	jar	3.2

test (1)

Group / Artifact	Type	Version
junit : junit	jar	4.11

Project Modules

There are no modules declared in this project.

Intro

The Maven Distribution Verifier Plugin allows verification of .jar, .war, .ear and .zip files. The content is checked against a defined whitelist. This ensures that only the expected artifacts with the respective fingerprint are included in your application distribution.

If there are any discrepancies in the defined hash values or files that are not defined during the verification process, a report is generated. In this way, the software artifact is additionally hardened in the quality assurance process.

Whitelist

The whitelist file whitelist.xml contains file name, path and the MD5 fingerprint.

Attribute	Description
path	File path within the Zip file
md5	File expects md5 hash. The attribute is optional. If missing, only checks whether the file exists.

<whitelist>
  <entry path="/Sample.md" />
  <entry md5="193fa5e788a1800a760d1108051c2363" path="/Sample.txt" />
</whitelist>

Report

After verification, all results are summarized in a report. The file report.xml contains information on both successful and faulty checks.

Each file is shown with a status and message.

The status can have the following values:

• SUCCESS

• FAILED

<report>
 <entry md5="4114b3e750902c5404ffe4864b3e11b8" path="/Sample.md">
    <result message="Validation passed successfully" status="SUCCESS" />
 </entry>
 <entry md5="193fa5e788a1800a760d1108051c4711" path="/Sample.txt">
    <result message="File found but with a different MD5 Checksum 193fa5e788a1800a760d1108051c2363"
            status="FAILED" />
 </entry>
 <entry md5="193fa5e788a1800a760d1108051c7778" path="/Sample.adoc">
    <result message="Defined file not found" status="FAILED" />
 </entry>
 <entry md5="0430eba9643b5e60e49c055eb16cbf7a" path="/Sample.adoc">
    <result status="FAILED" message="File is not defined in whitelist" />
 </entry>
</report>

Tools

Creating an initial whitelist, the commands find and md5sum can be combined on linux systems. Listing all files with path and MD5 hash in the whitelist structure, use this command:

cd path/to/your/directory
find * -type f -exec md5sum {} \; | awk '{printf "<entry path=\"/%s\" md5=\"%s\" />%s", $2, $1, "\n"}'

The <entry> elements are displayed on the console after the processing has been completed. These can then be transferred to your own whitelist.

<entry path="/Sample.md"   md5="4114b3e750902c5404ffe4864b3e11b8" />
<entry path="/Sample.text" md5="193fa5e788a1800a760d1108051c2363" />

dataliquid

Quality first. We build better enterprise software.

Versions

Version
1.0.1 Nov 17, 2019