Package: reportmix
ReportMixMerge reports frommultiple toolsinto a single file.InstallInstallReportMixfromPyPI:pipinstallreportmixUsageMerge reports using the command-line interface:reportmixArgumentsArgumentDescription-h,--helpShow the help message and exit-V,--versionShow program's version number and exit-v,--verboseRun verbosely (displayDEBUGlogging)--output_dir OUTPUT_DIRThe location to write the report--config_file CONFIG_FILEThe path to the configuration file--formats FORMATSReport formats to be generated (csv,json,html)--fields FIELDSFields to include in the output report (CSV and HTML only)--hash HASHFields to use for hash generation--title TITLEThe HTML report title--logo LOGOThe URL to the organization logo to display on the HTML report--meta.*User-defined metadata fieldsRunreportmix --helpto show the full help message.Some properties (formats,fields,hash, ...) support a single value
or a comma-separated list of items (e.g.--formats "csv,html,json").Tool-specific configuration arguments are documented in the help message
andbelow.ConfigurationConfigure the merging process usingcommand-line argumentsor create aconfiguration file.reportmixin the working directory:[global]output_dir=targetformats=html,csv,jsonfields=tool_name,tool_version,meta_organization,name,description,type,severity,subject_nametitle=Analysis reportlogo=http://acme.com/img/logo.png[meta]organization=Acme Corporation[dependency_check]report_file=target/dependency-check-report.csv[npm_audit]report_file=web-app/npm-audit.json[sonarqube]host_url=http://sonarqube.acme.corpproject_key=acme:myproject[reportmix]report_file=sub-project/reportmix.csvThis configuration can also be passed ascommand-line arguments:reportmix--output_dirtarget--formats"html,csv,json"\--fields[...]--title"Analysis report"--logo"http://acme.com/img/logo.png"\--meta.organization"Acme Corporation"\--dependency_check.report_file"target/dependency-check-report.csv"\--npm_audit.report_file"web-app/npm-audit.json"\--sonarqube.host_url"http://sonarqube.acme.corp"--sonarqube.project_key"acme:myproject"\--reportmix.report_file"sub-project/reportmix.csv"Metadata fieldsMetadata fields allow to define some fields for each issue in the configuration:NameDescriptionDefault valueproductThe product nameversionThe product versionorganizationThe organization nameclientThe client nameaudit_dateThe audit datenow()Hashhashis a special field. It is not extracted from the reports data but
computed using some of the issue fields to create a stable unique identifier.
If multiple issues, in a single merged report or in different reports,
generated at different times, have the samehashvalue, we can consider
they are the same, so solving one of them will solve the others. It can be
especially useful for computing a delta between multiple reports, tracking
issues fixes, etc.Supported reportsReports produced by the following tools are currently supported:Dependency-Check:
load a vulnerability report generated by OWASP dependency check
(CSV required, JSON optional), version 5.x is recommendednpm audit:
load a security audit generated by npm-audit CLI command
(JSON format only), npm@6 is requiredSonarQube:
load code quality analysis results from a SonarQube instance,
version 7.x is requiredReportMix:
load a report (CSV format) generated by ReportMix or manually createdContributions to improve existingreport loadersor add new ones are welcome!Dependency-Check loaderRuna Dependency-Check scan (cf.Maven plugin)TheCSVreport is required, theJSONreport is optional
(cf.formatproperty in the plugin configuration)Movedependency-check-report.*files in the working directory
orconfigureReportMix (dependency_check.report_file) to look for the file somewhere else:heavy_check_mark:Run ReportMix→Dependency-Check loadernpm audit loaderRuna security audit using thenpm-auditCLI commandGet the detailed audit report in JSON format, e.g.:npm audit --json > npm-audit.jsonMovethenpm-audit.jsonfile in the working directory
orconfigureReportMix (npm_audit.report_file) to look for the file somewhere else:heavy_check_mark:Run ReportMix→npm audit loaderSonarQube loaderRuna SonarQube analysis (cf.Analyzing Source Code)Configurethe instance URL (sonarqube.host_url), the project key (sonarqube.project_key),
andauthenticationsettings:heavy_check_mark:Run ReportMix→SonarQube loaderReportMix loaderRunReportMix (e.g. in another project) to generate a report (csvformat
required) orcreate it manuallyusing the ReportMix output format (e.g. to
include vulnerabilities from a manual security audit). A spreadsheet can be
used to easily create or edit a CSV report.Configurethe path to the CSV report file (reportmix.report_file):heavy_check_mark:Run ReportMix→ReportMix loaderLicenseReportMixis licensed under the GNU General Public License.