...
How to get it
The extension is published in the Microsoft Visual Studio Marketplace. You can install it in your Azure DevOps account directly from there, or download it to install it in your TFS server 2017 (15.0.*) or higher (Azure DevOps Server now).
| Info | ||
|---|---|---|
| ||
The minimum TFS version supported is 2015 Update 2 (14.95.25122.0). For TFS 2005 there may be some minor supporting features of the extension that may not fully work. This does not affect the automation of tasks and displaying the Kiuwan results after the builds. The extension is still fully operational. |
...
What you need to know before installing it
...
...
...
...
What you get with the extension
...
...
...
...
...
...
...
...
...
- Enter a name for the Kiuwan connection and configure your
...
...
...
...
...
...
- , configure your Kiuwan Domain ID provided by your Kiuwan administrator.
- , configure your Kiuwan Domain ID provided by your Kiuwan administrator.
| Info | ||
|---|---|---|
| ||
...
...
Build Tasks
The extension adds 2 new build task to your TFS/Azure DevOps Task Catalogue in the Build category. While editing a build definition, click "Add build step" to open the catalogue and look for the Kiuwan tasks.
Select the one you want to use and configure it.
Kiuwan credentials for your build tasks
In both build tasks, you have to select a Kiuwan connection previously configured in the project service endpoints configuration (see above). The credentials configured in the selected Kiuwan connection will be used to run the analysis.
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
- . Enter a name in the Kiuwan application name box.
Analysis label
...
...
Security analysis performance
When running security analyses only, you can improve the performance by skipping some analysis steps such as:
- Duplication of code detection that is not relevant for security
- Architecture analysis. If you have the architecture product available in your Kiuwan account you can skip the architecture analysis as well. The default is to skip it always.
Include Insights Analysis
Check this option when Insights product is available for your organization; if you want that Kiuwan Local Analyzer runs Insights analyses, and upload their results.
Upload code fragments of found defects
Uncheck this option if you do not want to upload the lines of code where defects and/or vulnerabilities are found. Note that these lines of code are essential for the proper functioning of certain features, such as the inspection of differences in results between analysis. If you disable it, these features may not work properly.
Upload analyzed source code files
Check this option if you want to use the functionality of the Kiuwan built-in code viewer, which allows you to see the full source code of your analyses.
Security analysis performance
To improve the performance when running security analyses, you can skip duplication of code detection, since it is not relevant for Security analyses results.
Database code analysis
If your project includes database code such as stored procedures for Oracle, SQL Server,
...
...
...
...
Advanced analysis settings
You can
...
...
...
...
...
...
...
...
...
...
...
You can also check the Kiuwan results directly in the Kiuwan tab of the TFS/Azure Job results:
...
...
...
...
...
Like with the baseline analysis tasks, you can specify some analysis options.
...
...
...
...
...
...
...
...
...
...
...
...
...
...
Change request status
...
...
...
...
...
...
...
Results
Remember that the overall result of the
...
...
...
...
of the audit and the defects and vulnerabilities that need to be fixed to pass it.
You can also check the Kiuwan results directly in the Kiuwan Audit tab of the TFS/Azure Job:
Set the Debug Variable
This section shows you the two options of how to set the debug variable in Azure DevOps/TFS pipelines to get the debug information from the execution of the tasks.
Option 1: Set a variable in each execution.
To execute the pipelines manually follow these steps:
- Use the Pipelines dialog to select more options of the execution from the list of pipelines. Select the pipeline you want to execute.
- Click the Run pipeline button
- When the Run pipeline dialog opens, click Variables.
- Click system.debug and change the value to "true".
- Click Update, go back to the run page of the dialog, and click Run.
Option 2: Set a variable for all the execution.
To set the variable for all the execution, follow these steps:
- Edit the pipeline you want to change.
- Go to the Variables tab and change the value of system.debug to "true". This change is persistent in all the pipeline execution and executes the tasks verbose.
Kiuwan Proxy Support
This section explains how to configure the TFS Azure plugin when a Proxy Server is needed. Before this configuration, take into account the following requirements: You are using Azure DevOps in the cloud, the installed local agent to run the pipelines are in LOCAL, and the internet access through a proxy server is needed.
Local Agent Configuration
When you are using a Local Agent to execute the Azure DevOps pipelines, you can see the agent from the Azure console listed under the Agent Pools screen, click the Default option:
The Default screen displays the Agents tab among others. You can review more information about the selected agent like the Name, when was the Last run, the Current status, the Agent Version, and the switch to Enable or Disable it. This is a hosted agent running in a physical or virtual machine in Linux, Mac or Windows OS.
Configure the Agent using a proxy server
You can configure the agent by using the Run a self-hosted agent behind a web proxy guide. Download the agent into a local folder and then configure it. If you are using a proxy server, execute the configuration command using the parameter to set the proxy:
| Code Block | ||
|---|---|---|
| ||
.\config.cmd --proxyurl 'http://${proxyhost}:${proxyport}' --proxyusername '${proxyusername}' --proxypassword '${proxypassword}' |
Where the different placeholders are:
${proxyhost}: the Proxy host (e.g. proxy.kiuwan.
...
com)
${proxyport}: the Proxy port (e.g. 3128)
${proxyusername}: your Proxy username for authentication
${proxypassword}: your Proxy password for authentication
As an example, here you can see a PowerShell with the command with all the parameters:
| Tip |
|---|
When using an Agent in any of the pipelines, you must specify the type of agent. |
The pipeline executes the Kiuwan analysis tasks in any agent available in the Default private agent pool, which refers to the Local Agent on Windows. Check the image below.
...