fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-UBUNTU2004-BASH-581100
- https://snyk.io/vuln/SNYK-UBUNTU2004-NETTLE-1303240
- https://snyk.io/vuln/SNYK-UBUNTU2004-NETTLE-1303240
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-1290722
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-1290722

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required (VERSION 3.1)
 
-project (rpc VERSION 1.2.0)
+project (rpc VERSION 1.2.1)
 
 set (CMAKE_CXX_STANDARD 11)
 

Dockerfile

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #*********************************************************************/
 
-FROM ubuntu:20.04 AS rpc-builder
+FROM ubuntu:20.10 AS rpc-builder
 
 WORKDIR /
 ARG DEBIAN_FRONTEND=noninteractive
@@ -11,7 +11,7 @@ RUN \
   apt-get update -y -qq && \
   apt install -y -qq \
     git cmake build-essential libssl-dev zlib1g-dev \
-    curl unzip zip pkg-config
+    curl unzip zip pkg-config ca-certificates
 RUN git clone https://github.com/open-amt-cloud-toolkit/rpc.git
 WORKDIR /rpc
 RUN mkdir -p build
@@ -23,7 +23,7 @@ WORKDIR /rpc/build
 RUN cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_TOOLCHAIN_FILE=/rpc/vcpkg/scripts/buildsystems/vcpkg.cmake ..
 RUN cmake --build .
 
-FROM ubuntu:20.04 
+FROM ubuntu:20.10 
 
 LABEL license='SPDX-License-Identifier: Apache-2.0' \
       copyright='Copyright (c) 2021: Intel'

Jenkinsfile

@@ -0,0 +1,171 @@
+pipeline {
+    agent none
+    options {
+        buildDiscarder(logRotator(numToKeepStr: '5', daysToKeepStr: '30'))
+        timestamps()
+        timeout(unit: 'HOURS', time: 2)
+    }
+    
+    stages {
+        stage ('Parallel') {
+            parallel {
+                stage ('Linux') {
+                    agent { label 'docker-amt' }
+                    stages {
+                        stage ('Cloning Repository') {
+                            steps {
+                                script {
+                                    scmCheckout {
+                                        clean = true
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                stage ('Windows') {
+                    agent { label 'openamt-win' }
+                    stages {
+                        stage ('Cloning Repository') {
+                            steps {
+                                script {
+                                    scmCheckout {
+                                        clean = true
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        stage ('Static Code Scan - Protex') {
+            agent { label 'docker-amt' }
+            steps {
+                script {
+                    staticCodeScan {
+                        // generic
+                        scanners             = ['protex']
+                        scannerType          = ['c','c++']
+
+                        protexProjectName    = 'OpenAMT - RPC'
+                        // internal, do not change
+                        protexBuildName      = 'rrs-generic-protex-build'
+                    }
+                }
+            }
+        }
+
+        stage ('Parallel Builds') {
+            parallel {
+                stage ('Linux') {
+                    agent { label 'docker-amt' }
+                    stages {
+                        stage('Build') {
+                            agent {
+                                docker {
+                                    image 'ubuntu:18.04'
+                                    reuseNode true
+                                }
+                            }
+                            steps {
+                                sh './scripts/jenkins-pre-build.sh'
+                                sh './scripts/jenkins-build.sh'
+                            }
+                        }
+                        stage ('Archive') {
+                            steps {
+                                archiveArtifacts allowEmptyArchive: true, artifacts: 'build/rpc', caseSensitive: false, onlyIfSuccessful: true
+                            }
+                        }
+                        
+                    }
+                }
+                stage ('Windows') {
+                    agent { label 'openamt-win' }
+                    stages{
+                        stage ('Build') {
+                            steps {
+                                bat 'scripts\\jenkins-pre-build.cmd'
+                                bat 'scripts\\jenkins-build.cmd'
+                                // prepare stash for the binary scan
+                                stash includes: "**/*.exe", name: 'rpc-app'
+                            }
+                        }
+                        stage ('Archive') {
+                            steps {
+                                archiveArtifacts allowEmptyArchive: true, artifacts: 'build\\Release\\rpc.exe', caseSensitive: false, onlyIfSuccessful: true
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        stage ('Parallel Scans') {
+            parallel {
+                stage ('Static Code Scan Linux') {
+                    agent { label 'docker-amt' }
+                    steps {
+                        script {
+                            staticCodeScan {
+                                // generic
+                                scanners             = ['bdba','klocwork']
+                                scannerType          = 'c++'
+
+                                protecodeGroup          = '25'
+                                protecodeScanName       = 'rpc-zip'
+                                protecodeDirectory      = './build/rpc'
+                                
+                                klockworkPreBuildScript = './scripts/jenkins-pre-build.sh'
+                                klockworkBuildCommand = './scripts/jenkins-build.sh'
+                                klockworkProjectName  = 'Panther Point Creek'
+                                klockworkIgnoreCompileErrors = true
+                            }
+                        }
+                    }
+                }
+                stage ('Static Code Scan Windows') {
+                    stages {
+                        stage ('Static Code Scan Windows - Klockwork') {
+                            agent { label 'openamt-win' }
+                            steps {
+                                script {
+                                    staticCodeScan {
+                                        // generic
+                                        scanners             = ['klocwork']
+                                        scannerType          = 'c++'
+                                        
+                                        klockworkPreBuildScript = 'scripts\\jenkins-pre-build.cmd'
+                                        klockworkBuildCommand = 'scripts\\jenkins-build.cmd'
+                                        klockworkProjectName  = 'Panther Point Creek'
+                                        klockworkIgnoreCompileErrors = true
+                                    }
+                                }
+                            }
+                        }
+                        stage ('Static Code Scan Windows - BDBA') {
+                            agent { label 'docker-amt' }
+                            steps {
+                                script {
+                                    sh "mkdir -p bdbaScanDir"
+                                    dir("bdbaScanDir") {
+                                        unstash 'rpc-app'
+                                    }
+                                    staticCodeScan {
+                                        // generic
+                                        scanners             = ['bdba']
+                                        scannerType          = 'c++'
+                                        
+                                        protecodeGroup          = '25'
+                                        protecodeScanName       = 'rpc-zip'
+                                        protecodeDirectory      = 'bdbaScanDir'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation. 
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project utilizing the guidelines [here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).

scripts/jenkins-build.cmd

@@ -14,7 +14,7 @@ set BASE_DIR=%cd%
 set VCPKG_DIR=C:\opt\vcpkg-source
 
 REM build RPC
-cd %BASE_DIR%/rpc
+
 
 if exist "build" rd /q /s "build"
 
@@ -23,4 +23,4 @@ cd build
 echo %VCPKG_DIR%\vcpkg\scripts\buildsystems\vcpkg.cmake
 cmake -DVCPKG_TARGET_TRIPLET=x64-windows-static -DCMAKE_TOOLCHAIN_FILE=%VCPKG_DIR%\vcpkg\scripts\buildsystems\vcpkg.cmake ..
 cmake --build . --config Release
-dir %BASE_DIR%\rpc\build
+dir %BASE_DIR%\build

scripts/jenkins-build.sh

@@ -5,9 +5,9 @@ set -x
 # Jenkins Build script
 #   - Ubuntu 18.04
 #
-
+export BASE_DIR="$PWD"
 export CMAKE_CXX_FLAGS="-isystem /usr/lib/gcc/x86_64-linux-gnu/7/include"
-cd "$BASE_DIR"/rpc
+
 
 if [ -d "build" ]; then
   rm -rf build
@@ -15,5 +15,5 @@ fi
 
 mkdir build
 cd build
-cmake -DCMAKE_TOOLCHAIN_FILE="$BASE_DIR"/rpc/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_BUILD_TYPE=Release ..
+cmake -DCMAKE_TOOLCHAIN_FILE="$BASE_DIR"/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_BUILD_TYPE=Release ..
 cmake --build .

scripts/jenkins-pre-build.sh

@@ -4,14 +4,15 @@
 #   - Ubuntu 18.04
 #
 
-sudo apt install git cmake build-essential curl zip unzip tar pkg-config
+apt update
+apt install git cmake build-essential curl zip unzip tar pkg-config -y
 
 ## current dir - RPC source directory
-export BASE_DIR="$PWD"
+#export BASE_DIR="$PWD"
 
-cd "$BASE_DIR"/rpc
+#cd "$BASE_DIR"/rpc
 ## build vcpkg
-git clone --branch 2020.11-1 https://github.com/microsoft/vcpkg.git
+git -C vcpkg pull || git clone --branch 2020.11-1 https://github.com/microsoft/vcpkg.git vcpkg
 cd vcpkg
 ./bootstrap-vcpkg.sh
 

usage.cpp

@@ -49,15 +49,15 @@ void usage_show_help()
     std::cout << "Examples:"                                                                        << std::endl;
     std::cout << "  # Activate platform using profile1"                                             << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " --url wss://localhost:8080 --cmd \"-t activate --profile profile1\""                       << std::endl;
+       " --url wss://192.168.86.100/activate --cmd \"-t activate --profile profile1\""              << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Activate platform using profile1 and override DNS detection" << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " --url wss://localhost:8080 --cmd \"-t activate --profile profile1\" --dns corp.com"        << std::endl;
+       " --url wss://mycloud.com/activate --cmd \"-t activate --profile profile1\" --dns corp.com"  << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Deactivate platform and connect through a proxy"                              << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " -u wss://localhost:8080 -c \"-t deactivate --password P@ssw0rd\" -p http://proxy.com:1000" << std::endl;
+       " -u wss://mycloud.com/activate -c \"-t deactivate --password P@ssw0rd\" -p http://proxy.com:1000" << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Show all informational items"                                                 << std::endl;
     std::cout << "  " << PROJECT_NAME << " --amtinfo all"                                           << std::endl;