Fortify and Team Foundation Server

Do you have Team Foundation Server (TFS) and Fortify and wish they can work together automatically. This article will show one way of making fortify run every time you run a build on the Team Build server. After your build is completed a list of people will receive emails containing the fortify reports. Fortify reports will contain an fpr file that can be opened with the Audit work bench, an html file that can be opened with Internet explorer in addition to a log file.

Let's look at how we will do this.

Using Team Build we will override the "AfterComplie" target to add one Task this task will simply be an exec task. the exec task will run a batch file. This batch file will do all the fortify things. It will run fortify and email the files.

Let's see how we will do that in a step by step way.

Step 1:

-----------

Override the AfterComplie Target.

To do that, Check out your TFSBuild.Proj and just before the closing your Project element add the code highlighted in the screen shot above. in a nutshell what you need is an exec task as follows

The exec task will run fortify in from a batch file.

there are more than that in the screen shot above to use the ASPNetComplier task to combine your website dll's into one.

Step 2

---------------

Create runfortify.bat

Typically this file should look as follows

Rem 1. [CLEAN] Must clean first to clean C:\Documents and Settings\C649318\Local Settings\Application Data\Fortify\sca5.7\build

"E:\Program Files\Fortify Software\Fortify 360 v2.1.0\bin\sourceanalyzer" -b mybuild -clean

Rem 2. [TRANSLATE] Must translate second to create the intermediary Fortify Files. Must build solution first and use the Dll's folder of the solution. use -libdirs to reference any external dll's

"E:\Program Files\Fortify Software\Fortify 360 v2.1.0\bin\sourceanalyzer" -b mybuild -vsversion 8.0 -libdirs "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\KPHC.Integration.WebUI\Bin" "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\KPHC.Integration.WebUI\Bin" -debug -logfile "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\fortifyTranslate.log"

REM [SCAN] and create an fpr and xml file in addition to logs

"E:\Program Files\Fortify Software\Fortify 360 v2.1.0\bin\sourceanalyzer" -b mybuild -scan -f "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\FortifyIssues.fpr" -html-report -debug -logfile "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\fortifyScan.log"

RunFortify.exe "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\FortifyIssues.fpr" "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\FortifyIssues.html" "C:\Documents and Settings\tfsservice\Local Settings\Temp\[ProjectName]\fortify\Sources\Main\Source\fortifyScan.log" "myemail@mydomain.com"

you will notice that the batch file also runs a program called RunFortify.exe this is a program that I created, all it does is to email the fpr, html and log files to a specific email address. I am not going to discuss this exe in this post. you can create your own exe that does that or use TFS to email the files.