Category Archives: Open Source

SWAMP Software Is Open Source

Software from the SWAMP is open source! You may already have your own SWAMP-in-a-Box, a private/local instance of SWAMP, or our plug-ins for Eclipse, Jenkins, and Git/Subversion. But did you know that more of our software is also available on GitHub?

  • The assessment frameworks help to build and assess software in the SWAMP.
  • The results parser converts the output of software assessment tools into the SWAMP Common Assessment Result Format (SCARF).
  • Other software puts SCARF into a database.
  • Our libraries let clients read/write SCARF and perform common operations in the SWAMP.

To learn more and to review or download our code, visit the new Open Source Software page!

SWAMP-in-a-Box Update 1.30.114

We have released an update to SWAMP-in-a-Box (SiB) version 1.30. SiB release v1.30.114 contains a few bug fixes and a patch to allow the SWAMP plug-ins to work with SiB. If you have already downloaded or installed SiB v1.30 (v1.30.113), you are not required to download the latest update unless you would like to use the SWAMP plug-ins with your SiB instance.

The updated SWAMP-in-a-Box v1.30.114 is now available for download here or on GitHub. Note that you may still see the version reflected as 1.30, as not all files received the updated 1.30.114 version number, but all appropriate files have been updated.

Let us know if you have any questions at sib@continuousassurance.org.

SWAMP-in-a-Box Update 1.30

SWAMP-in-a-Box version 1.30 is now available for download! The latest files are on GitHub, or you can download the install files here.

Noteworthy changes include:New

  • SWAMP-in-a-Box can now be configured to use an LDAP or LDAP-compatible Active Directory server for managing user accounts.
  • SWAMP-in-a-Box can now be configured to allow GitHub, Google, and CILogon accounts to be linked to SWAMP user accounts, allowing users to sign into the SWAMP using their third-party credentials.
  • The GrammaTech CodeSonar tool for assessing C/C++ packages can now be added to a SWAMP-in-a-Box installation. You must license CodeSonar and obtain either the 32-bit or 64-bit installers for CodeSonar separately from GrammaTech, Inc.
  • SWAMP users can now add Application Passwords to their SWAMP accounts. These passwords can be used with the SWAMP plugins for Eclipse and Jenkins to allow them to connect to the SWAMP without using the users’ main passwords.
  • Java 8 is now the default Java version when creating new Java source and Java bytecode packages.
  • The SWAMP now uses the “recursive” option to include linked sub-modules when pulling code from GitHub to create a new package or when adding a new package version.
  • The Native viewer for assessment results now includes information about the package, tool, and platform used, along with start and completion times, for the assessment.
  • SWAMP users can now change their SWAMP username when editing their profile page.
  • Added new versions and/or updates for the following assessment tools: Brakeman, Dawn, Reek, RuboCop, and ruby-lint.
  • The SWAMP-in-a-Box install and upgrade scripts now configure the web server (Apache) to disallow HTTP connections. The SWAMP must be accessed using HTTPS.
  • The SWAMP-in-a-Box install and upgrade scripts no longer attempt to configure firewall settings on the host. Required configuration is now documented in the `README-BUILD-SERVER.md` file that is included with the SWAMP-in-a-Box installer.
  • General enhancements and bug fixes.

Let us know if you have any questions at sib@continuousassurance.org.

SWAMP is at OSCON 2017!

If you are in Austin, TX this week for OSCON 2017, the SWAMP Team wants to see you! If you still need to register for the conference, use our discount code, SWAMP25, to save 25% on your admission.

Visit the Software Assurance Marketplace in Booth #518 on May 10th and 11th! We will be demoing our new plug-ins along with the newest features in SWAMP-in-a-Box.

Several SWAMP team members will also be giving presentations during the conference:

Read more about the SWAMP’s activities here.

OSCON 2017 Exhibiting Banner

SWAMP & Secure Development for the Cloud

MISTI logoIn today’s MISTI blog post, “Secure Development for the Cloud,” author Randall Brooks mentions SWAMP and SWAMP-in-a-Box as great resources for organizations with limited funds who are looking for secure coding solutions. Incorporating many free and open-source analysis tools, the Software Assurance Marketplace offers both cloud-based and on-premises solutions for continuous software assurance. Read the full article.

Brooks will also be presenting at the upcoming 2017 InfoSec World Conference in Orlando. Session B4 “Secure Development for the Cloud” will include a bit about the SWAMP. Catch the presentation on Monday, April 3 at 2:15pm-3:05pm.

SWAMP-in-a-Box Update 1.29

SWAMP-in-a-Box version 1.29 is now available for download! The latest files are on GitHub, or you can download the install files here. Noteworthy changes include:New

  • Added support for 5 new programming languages: CSS, HTML, JavaScript, PHP, and XML.
  • Addition of 9 assessment tools for web scripting languages: CSS Lint (for CSS), ESLint (for JavaScript), Flow (for JavaScript), HTML Tidy (for HTML and XML), JSHint (for JavaScript or HTML files with inline JavaScript), PHPMD (for PHP), PHP_CodeSniffer (for PHP, JavaScript, and CSS), Retire.js (for JavaScript), and XML Lint (for XML).
  • Added new versions and/or updates for the following assessment tools: Bandit, Flake8, Pylint, checkstyle, OWASP Dependency Check, error-prone, FindBugs, and PMD.
  • When adding a new package or adding a new version to an existing package, users have the option to select an archive file from the local file system or enter an external URL and a checkout argument (branch, tag, or commit) for a remote Git repository.
  • Improved error reporting for assessment failures. Successful assessment runs are no longer erroneously reported as having finished with errors. Assessments that complete with a status of “finished with errors – retry” can be re-run and should complete successfully.
  • Updated the “Status.out and Debugging SWAMP Failures” document to assist with debugging failed assessments. Failed assessments now show the contents of the status.out file at the top of the Failed Assessment Report (by clicking the “! Error” button in the Results column).
  • The names of the statuses shown on the Results page have been updated to better indicate what is happening as assessment jobs are processed.
  • Minimum hardware requirements have increased to 4 CPU cores and 16 GB of RAM.

Let us know if you have any questions at sib@continuousassurance.org.

See SWAMP at OSCON 2017

If you will be in Austin, TX this May for OSCON 2017, stop by to see the SWAMP Team! When registering for the conference, use our discount code, SWAMP25, to save 25% on your admission, and be sure to look out for the Software Assurance Marketplace in Booth #518 on May 10th and 11th!

Several SWAMP team members will be giving presentations at the conference, in addition to demoing the latest enhancements to SWAMP and SWAMP-in-a-Box!

OSCON 2017 Exhibiting Banner

« Older Entries