Add SAST/DAST into the testing pipeline #5

New Issue

DarkFeather · 2023-02-22T22:17:42-06:00

DarkFeather commented

2023-02-22 22:17:42 -06:00

We should add SAST as part of a universal testing framework on all packages prior to delivery. semgrep is a freeware option already in the AUR.

We should also consider adding some kind of DAST pipeline with ossf/package-analysis, though this will require including a Docker environment for testing.

SAST should get implemented first, and then DAST can follow.

We should add SAST as part of a universal testing framework on all packages prior to delivery. [semgrep](https://aur.archlinux.org/packages/semgrep-bin) is a freeware option already in the AUR. We should also consider adding some kind of DAST pipeline with [ossf/package-analysis](https://github.com/ossf/package-analysis), though this will require including a Docker environment for testing. SAST should get implemented first, and then DAST can follow.

DarkFeather commented

2023-11-09 13:24:52 -06:00

This replaces AniNIX/Wiki#4.

Potential tools:

Bandit for SAST
Zed Attack Proxy for DAST
DefectDojo

This replaces AniNIX/Wiki#4. Potential tools: * [Bandit](https://pypi.org/project/bandit/) for SAST * [Zed Attack Proxy](https://www.zaproxy.org/) for DAST * [DefectDojo](https://github.com/DefectDojo/django-DefectDojo)

Sign in to join this conversation.