New port: security/owasp-dependency-check

Dependency-Check is a utility that attempts to detect publicly disclosed
vulnerabilities contained within project dependencies. It does this by
determining if there is a Common Platform Enumeration (CPE) identifier
for a given dependency. If found, it will generate a report linking to
the associated CVE entries.

WWW: https://github.com/jeremylong/DependencyCheck
WWW: https://www.owasp.org/index.php/OWASP_Dependency_Check
WWW: https://jeremylong.github.io/DependencyCheck/dependency-check-cli/
WWW: https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html

PR:		226206
Submitted by:	Andreas Sommer <andreas.sommer87@googlemail.com>

5 files changed, 100 insertions, 0 deletions

diff --git a/security/owasp-dependency-check/Makefile b/security/owasp-dependency-check/Makefile
new file mode 100644
index 000000000000..f7a7854e997f
--- /dev/null
+++ b/security/owasp-dependency-check/Makefile
@@ -0,0 +1,46 @@
+# $FreeBSD$
+
+# Note to committers:
+# With each version update, a new maven repository must be created and distributed
+# so build is repeatable and cluster-safe.
+
+PORTNAME=	owasp-dependency-check
+PORTVERSION=	3.1.1
+DISTVERSIONPREFIX=	v
+CATEGORIES=	security java
+MASTER_SITES=	LOCAL/pi/:source2
+DISTFILES+=	owasp-dependency-check-${PORTVERSION}-maven-repository.tar.gz:source2
+
+MAINTAINER=	andreas.sommer87@googlemail.com
+COMMENT=	Detects publicly disclosed vulnerabilities in project dependencies
+
+LICENSE=	APACHE20
+
+BUILD_DEPENDS=	${LOCALBASE}/share/java/maven/bin/mvn:devel/maven
+
+USE_GITHUB=	yes
+GH_ACCOUNT=	jeremylong
+GH_PROJECT=	DependencyCheck
+
+USE_JAVA=	yes
+JAVA_VERSION=	1.7+
+
+NO_ARCH=	yes
+
+SUB_FILES=	owasp-dependency-check
+SUB_LIST=	PORTVERSION=${PORTVERSION}
+PLIST_DIRS=	/var/cache/owasp-dependency-check
+PLIST_FILES=	bin/owasp-dependency-check \
+		${JAVAJARDIR}/owasp-dependency-check-${PORTVERSION}-jar-with-dependencies.jar
+
+do-build:
+	cd ${WRKSRC} && ${SETENV} ${MAKE_ENV} ${LOCALBASE}/share/java/maven/bin/mvn \
+		--batch-mode -Dmaven.repo.local=${WRKDIR}/repository -DskipTests --offline package
+
+do-install:
+	${INSTALL_DATA} ${WRKSRC}/dependency-check-cli/target/dependency-check-${PORTVERSION}-jar-with-dependencies.jar \
+		${STAGEDIR}${JAVAJARDIR}/owasp-dependency-check-${PORTVERSION}-jar-with-dependencies.jar
+	${INSTALL_SCRIPT} ${WRKDIR}/${PORTNAME} ${STAGEDIR}${PREFIX}/bin
+	${MKDIR} ${STAGEDIR}/var/cache/owasp-dependency-check
+
+.include <bsd.port.mk>
diff --git a/security/owasp-dependency-check/distinfo b/security/owasp-dependency-check/distinfo
new file mode 100644
index 000000000000..6655a77134ce
--- /dev/null
+++ b/security/owasp-dependency-check/distinfo
@@ -0,0 +1,5 @@
+TIMESTAMP = 1522498032
+SHA256 (owasp-dependency-check-3.1.1-maven-repository.tar.gz) = 27d27cfa9659c0c4b03dc311e994570641caa2b5db558731bea2a1904fca31b9
+SIZE (owasp-dependency-check-3.1.1-maven-repository.tar.gz) = 110896009
+SHA256 (jeremylong-DependencyCheck-v3.1.1_GH0.tar.gz) = 63c89d2263a5dd01f7cc44e22b1172989192b928ff1b650277ffec13e5d168eb
+SIZE (jeremylong-DependencyCheck-v3.1.1_GH0.tar.gz) = 70973557
diff --git a/security/owasp-dependency-check/files/owasp-dependency-check.in b/security/owasp-dependency-check/files/owasp-dependency-check.in
new file mode 100644
index 000000000000..66fd4b7e32b1
--- /dev/null
+++ b/security/owasp-dependency-check/files/owasp-dependency-check.in
@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# $FreeBSD$
+
+# By default, this writes to /var/cache/owasp-dependency-check/data/dc.h2.db to cache vulnerability databases.
+# Both read and write access to the cached database requires an exclusive lock file inside the same directory
+# (even with `--noupdate`), so it's recommended to specify `--data PATH_TO_DATA_DIRECTORY` to ensure usability
+# of the database by non-root users. Without the parameter, it defaults to write files into
+# /var/cache/owasp-dependency-check/data.
+#
+# `--cve*` arguments fix https://github.com/jeremylong/DependencyCheck/issues/1171 until the changed URLs
+# get released.
+JAVA_VERSION="%%JAVA_VERSION%%" \
+	"%%LOCALBASE%%/bin/java" \
+	-Dbasedir="/var/cache/owasp-dependency-check" \
+	-jar "%%JAVAJARDIR%%/owasp-dependency-check-%%PORTVERSION%%-jar-with-dependencies.jar" \
+	--cveUrl12Base "https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-%d.xml.gz" \
+	--cveUrl20Base "https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-%d.xml.gz" \
+	--cveUrl12Modified "https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-modified.xml.gz" \
+	--cveUrl20Modified "https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-modified.xml.gz" \
+	"$@"
diff --git a/security/owasp-dependency-check/files/patch-dependency--check--cli-pom.xml b/security/owasp-dependency-check/files/patch-dependency--check--cli-pom.xml
new file mode 100644
index 000000000000..f0561fd156b9
--- /dev/null
+++ b/security/owasp-dependency-check/files/patch-dependency--check--cli-pom.xml
@@ -0,0 +1,18 @@
+--- dependency-check-cli/pom.xml.orig	2018-01-29 03:12:27 UTC
++++ dependency-check-cli/pom.xml
+@@ -91,7 +91,15 @@ Copyright (c) 2012 - Jeremy Long. All Ri
+                 <groupId>org.apache.maven.plugins</groupId>
+                 <artifactId>maven-assembly-plugin</artifactId>
+                 <configuration>
++                    <archive>
++                        <manifest>
++                            <mainClass>org.owasp.dependencycheck.App</mainClass>
++                        </manifest>
++                    </archive>
+                     <attach>false</attach> <!-- don't install/deploy this archive -->
++                    <descriptorRefs>
++                        <descriptorRef>jar-with-dependencies</descriptorRef>
++                    </descriptorRefs>
+                 </configuration>
+                 <executions>
+                     <execution>
diff --git a/security/owasp-dependency-check/pkg-descr b/security/owasp-dependency-check/pkg-descr
new file mode 100644
index 000000000000..6ae2769c27b9
--- /dev/null
+++ b/security/owasp-dependency-check/pkg-descr
@@ -0,0 +1,10 @@
+Dependency-Check is a utility that attempts to detect publicly disclosed
+vulnerabilities contained within project dependencies. It does this by
+determining if there is a Common Platform Enumeration (CPE) identifier
+for a given dependency. If found, it will generate a report linking to
+the associated CVE entries.
+
+WWW: https://github.com/jeremylong/DependencyCheck
+WWW: https://www.owasp.org/index.php/OWASP_Dependency_Check
+WWW: https://jeremylong.github.io/DependencyCheck/dependency-check-cli/
+WWW: https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html