Category Archives: Open Source

SWAMP-in-a-Box Update 1.34

SWAMP-in-a-Box version 1.34 is now available! The latest files can be found on GitHub or obtained from the SWAMP-in-a-Box download server.

Noteworthy changes include:New

  • SWAMP-in-a-Box now supports the upload and assessment of .NET packages that can be built using msbuild on Linux. SWAMP automatically reviews Solution and .NET project files and determines which can be built using a framework that does not require Windows. Users can then select which of those .NET projects to assess. Python 3.4 is now installed as an OS dependency for SWAMP-in-a-Box; this is required for the analysis of uploaded .NET packages to determine which .NET projects can be assessed on a Linux platform.
  • We added three tools for the assessment of .NET packages on a Linux platform: Code Cracker v1.1.0, devskim 0.1.10, and Security Code Scan 2.7.1. These tools are automatically deployed on SWAMP-in-a-Box.
  • GitHub Webhooks can now be configured to update SWAMP packages. When the GitHub Webhook is triggered, a new package version will be added to an existing SWAMP package. Package parameters are copied from the previous package version and used with a new archive of package code cloned from GitHub. Users can edit package information to get the Payload URL and set the Secret Token needed to configure a GitHub Webhook to the SWAMP.
  • A new schedule is now available for use in all projects. This schedule, “On Push,” runs assessments whenever a new push to a GitHub repository triggers a GitHub Webhook to generate a new Package Version in the SWAMP. This schedule works with an assessment for the “latest” version of a package that is configured to update based on a GitHub Webhook trigger.
  • Assessments of Android Java Source and Android .APK packages can be enabled in SWAMP-in-a-Box. To do so, download and install as an add-on the Android Ubuntu platform image. (It is quite large.) When that platform is added, the Android Java Source and Android .APK package types are enabled. Android specific tools are installed with SWAMP-in-a-Box 1.34, but they cannot be used for assessments until the Android Ubuntu platform is added.
  • SWAMP packages can now be generated via an External URL that points to a downloadable archive.
  • For users who are in multiple projects, the associated project is now displayed for records on the Package, Assessments, Assessment Results, and Scheduled Assessment Runs pages. Additionally, users can specifically set the project when adding new assessments.
  • HTCondor is now configured to preempt an assessment or metric run to create a slot for a Code Dx viewer run when all slots are in use.
  • An updated version of the Ubuntu Linux version 16.04 platform is now available and will be automatically installed with SWAMP-in-a-Box 1.34.
  • The platform image files for all SWAMP platforms have been updated to provide a workaround for a bug in guestfish version 1.38 ( SWAMP 1.34 is required to run VMs with the new platforms, which have a date in the filename of 2019 or later. SWAMP 1.34 is compatible with pre-2019 versions of platforms; however, pre-2019 platforms will not currently work with guestfish 1.38 (which is distributed with the latest CentOS 7). If you are running a SWAMP-in-a-Box in CentOS 7, you should upgrade to SWAMP-in-a-Box 1.34 and upgrade any additional platforms you have installed as add-ons.
  • There is now a script available to restore a database backup (made as part of the SWAMP-in-a-Box upgrade process). Refer to the SWAMP-in-a-Box Administrator Guide for details.
  • You can now configure SWAMP-in-a-Box to display a custom welcome message on the home page (not signed-in). Refer to the SWAMP-in-a-Box Administrator Guide for details.
  • We updated the SWAMP configuration for all available versions of the Flake8 assessment tool. This allows Flake8 to be configured in a SWAMP-in-a-Box environment. Specifically, parameters can be set in the services.conf file for the SWAMP to enable checks, disable checks, and set the max-line-length for line length checks.
  • We changed the way the web front-end for SWAMP-in-a-Box identifies the corresponding web server. Specifically, the web server configured in /var/www/html/config/config.json is now a relative path instead of an absolute URL. This change affects the way the Java CLI and related SWAMP plugins connect to a SWAMP-in-a-Box API. SWAMP plugins have been updated to accommodate this change. SWAMP-in-a-Box 1.34 will only work with the following versions: Java CLI version 1.5.2 or higher; SWAMP Eclipse Plugin version 1.1.2 or higher; SWAMP Jenkins Plugin version 1.2.1 or higher.
  • The SWAMP discontinued support for the Ubuntu 10.04 assessment platform. If this platform was installed as an add-on, it will be removed when upgrading to SWAMP-in-a-Box 1.34.
  • General enhancements and bug fixes.

Let us know if you have any questions at

SWAMP-in-a-Box v1.33.4 Compatibility Issue

SWAMP-in-a-Box version 1.33.4 and previous versions are not compatible with the latest version of guestfish (libguestfs 1.38.2), which is included in CentOS 7.6.

Specifically, assessments will not run and results cannot be viewed in Code Dx. When running an assessment, the status “htcondor submit aborted – uuid queued” or “failed to launch” is displayed on the Assessment Results page. When attempting to view results in Code Dx, “Unable to Start VM” is displayed on the Preparing Results page.

Performing a ‘yum update’ on an existing SWAMP-in-a-Box installation on CentOS 7 will install guestfish 1.38.2. Likewise, running the ‘install-all.bash’ script to install required dependencies for a new SWAMP-in-a-Box installation on CentOS 7 will install guestfish 1.38.2.


To determine which version of guestfish is installed, run the following command:
# guestfish –version


To downgrade to a version of guestfish that is compatible with SWAMP-in-a-Box version 1.34.4, do the following:

1. Download these files and move them to your SWAMP-in-a-Box:

2. ‘cd’ to the directory containing the files downloaded above

3. Downgrade the guestfish packages to 1.36.10 (may require ‘sudo’)
# yum downgrade ./libguestfs* ./perl-Sys-Guestfs*

4. Update permission on the platforms directory (may require ‘sudo’)
# chmod 755 /swamp/platforms/images


This issue does not affect a SWAMP-in-a-Box install on CentOS 6. The version of guestfish available for CentOS 6.10 is currently version 1.20.11.

Let us know if you have any questions at

Software Assurance Conference 2018

The SWAMP will be presenting and demonstrating at Software Assurance Conference 2018! SwACon is a software assurance (SwA) conference dedicated to advancing the state of the art in software assurance disciplines. The theme of this year’s event is open source tools and techniques that are available for SwA activities. The event is hosted by the Software Engineering Institute (SEI) in collaboration with the DoD Joint Federated Assurance Center (JFAC).

SwACon 2018 will be held on Tuesday, November 27 at the NRECA Conference Center (4301 Wilson Blvd. Arlington, VA – 1st floor). There will be presentations all day, roughly from 9am to 5pm Eastern, and you may attend only selected presentations, if needed. The event is free of charge but does require advance registration. Remote participation will also be available. To register, email for details before November 18.



SwACon 2018
November 27th, 2018
NRECA Conference Center (1st floor)
Arlington, VA

8:45AM to 9:30AM    Check-in and Registration; Light breakfast items to be served

9:30AM to 10:45AM   Getting Started with ROSE Compiler Infrastructure – Dan Quinlan

ROSE is an open source compiler infrastructure to build source-to-source program transformation and analysis tools for large-scale C (C89 and C98), C++ (C++98 and C++11), UPC, Fortran (77/95/2003), OpenMP, Java, Python, and PHP applications. ROSE is developed at Lawrence Livermore National Laboratory (LLNL). Presented by Dr. Dan Quinlan, LLNL.

10:45AM to 11:00AM  Morning beverage break

11:00AM to 12:00PM  Introduction to Binary Analysis with Pharos – Cory Cohen

The SEI’s Pharos project is an open-source static binary analysis framework that is primarily targeted at malware analysis but can also be used for software assurance tasks. Presented by Cory Cohen, SEI.

12:00PM to 1:00PM   Lunch break – participants on their own for lunch

1:00PM to 2:30PM    Introduction to Software Assurance Marketplace (SWAMP) - Von Welch & Brian Aydemir

Join us to learn about the Software Assurance Marketplace (SWAMP) – a Continuous Software Assurance Platform. During this presentation, we will introduce the SWAMP project and team, describe SWAMP’s capabilities, present a live demo, and explain how you can start using the SWAMP. Presented by Von Welch, Director of Indiana University – Center for Applied Cybersecurity Research (CACR) & Brian Aydemir, Systems Integration Developer, Morgridge Institute for Research/SWAMP.

2:30PM to 2:45PM    Afternoon break; Light snacks to be served

2:45PM to 3:45PM    Securing Software with Trail of Bits – Peter Goodman & Trent Brunson

3:45PM to 3:55PM    Short transition break

3:55PM to 4:55PM    Introduction to Source Code Analysis Laboratory (SCALe)  - Lori Flynn

SWAMP-in-a-Box Update v1.33.4

SWAMP-in-a-Box version 1.33.4 is now available from GitHub or the SWAMP-in-a-Box download server.

Noteworthy changes include:New

  • An updated version of the Ubuntu Linux version 16.04 platform is now available and will be automatically installed with SWAMP-in-a-Box 1.33.4.
  • SWAMP-in-a-Box now automatically re-tries (up to three additional times) assessments that finish with an error related to networking. This includes assessments for which a VM does not have network connectivity or for which OS dependencies cannot be installed. In many cases, these assessments succeed on the first retry.
  • SWAMP-in-a-Box administrators can now configure which viewer is initially selected on the Assessment Results page. When SWAMP-in-a-Box 1.33.4 is installed, this configuration is set to use the Native Viewer. Note that this is only applicable if a third-party viewer has been added to SWAMP-in-a-Box.
  • Parasoft C/C++test versions 10.3.4 and 10.4.0 can now be added to a SWAMP-in-a-Box installation. You must license Parasoft C/C++test and obtain either the 32-bit or 64-bit tool archive files separately from Parasoft.
  • Parasoft Jtest versions 10.3.4 and 10.4.0 can now be added to a SWAMP-in-a-Box installation. You must license Parasoft Jtest and obtain the 64-bit tool archive files separately from Parasoft. 
  • General enhancements and bug fixes.

Let us know if you have any questions at

SWAMP Plug-Ins Updates

Updates are now available for the following SWAMP plug-ins:

If a user submits an assessment with a tool that they do not have permission to use, the assessment is not submitted and an error is reported to the user.

SWAMP plug-ins can be found in the Jenkins and Eclipse marketplaces and on GitHub:

SWAMP Plug-Ins Updates

Updates are now available for the following pieces of SWAMP open-source software!

  • Java-CLI version 1.5.3
  • SWAMP-Jenkins-Plugin version 1.2.2
  • SWAMP-Eclipse-Plugin version 1.1.3

These updates address a cookie expiration issue that was impacting plug-ins used with SWAMP-in-a-Box instances that did not have the time set to current.

SWAMP plug-ins can be found in the Jenkins and Eclipse marketplaces and on GitHub:

SWAMP is coming to OSCON 2018!

O'Reilly Open Source Convention in Portland 2018
The SWAMP will be at OSCON 2018 this week, and we want to see you in Portland, OR! Use our discount code, SWAMP25, to save 25% on your Gold, Sliver, or Bronze OSCON pass, if you still need to register for the conference.

The Software Assurance Marketplace will be in Booth #322 on July 18-19. Our team will be demoing the latest enhancements to SWAMP and SWAMP-in-a-Box. Please stop by to hear about what the SWAMP project and continuous software assurance have to offer!

« Older Entries