Sonar Evidence Integration

The Evidence Collection service can convert Sonar attestations generated by SonarQube into JFrog evidence. All forms of evidence subjects are supported, including artifacts, packages, builds, and Release Bundles. The following jf evd create command shows a sample Sonar integration:

jf evd create --build-name <build-name> --build-number <build-number> --integration sonar --key <path-to-key> --key-alias <key-alias>

Where:

• <build-name>: The name of the build associated with the Sonar scan
• <build-number>: The build number associated with the Sonar scan
• <path-to-key>: Path to the private key used to sign the evidence
• <key-alias>: The alias of the public key used to verify the evidence

For example:

jf evd create --build-name my-app-build --build-number 42 --integration sonar --key ./private.pem --key-alias sonar-signing-key

Prerequisites

• SONAR_TOKEN or SONARQUBE_TOKEN environment variable for fetching the data from Sonar
• report-task.txt which contains the output of the Sonar code scan. These are the default locations for this file.

Configuration Options

You can use either environment variables or a YAML file to set configuration options for Sonar evidence. The YAML file, named evidence.yml or evidence.yaml, is looked up in a .jfrog/evidence/ folder found by searching upward from the current directory. If none is found, JFrog CLI falls back to its home directory (~/.jfrog/evidence/).

Sample evidence.yml/evidence.yaml file

sonar:
  url: https://sonarcloud.io
  reportTaskFile: /path/to/report-task.txt
  pollingMaxRetries: 30
  pollingRetryIntervalMs: 5000

Related Topics

• Create Evidence CLI - Sample Commands
• Generate Evidence Key Pair CLI
• Get Evidence CLI