pw_fortifier#

Tools and frameworks for defensive development

Experimental Python

Find and fix your security weaknesses before attackers do!

pw_fortifier provides a framework to build tools that can harness agents and automate several key steps in sustaining secure software development:

  • Find software vulnerabilities in your code, and stale third-party packages in your build.

  • Filter out false positives and duplicate findings.

  • Assess the impact of findings on your product.

  • Automatically fix and test vulnerabilities and update dependencies.

  • Export results to be published to project dashboards.

Try it out!#

A sample freshness scanner is included in pw_fortifier that scans several types of third party dependencies.

Run it from within your project directory using the command line:

# Run a full scan across the entire repository
$ bazelisk run @pigweed//pw_fortifier/py:demo_freshness_scanner -- -b

# List all generated issues.
$ bazelisk run @pigweed//pw_fortifier/py:demo_issue_tracker

# View a specific generated issue.
$ bazelisk run @pigweed//pw_fortifier/py:demo_issue_tracker -- \
    --issue 8675309

$ cd path/to/pigweed/pw_fortifier/py

# Run a full scan across the entire repository
$ python3 demo_freshness_scanner.py -b

# List all generated issues.
$ python3 -m pw_fortifier.demo_issue_tracker

# View a specific generated issue.
$ python3 -m pw_fortifier.demo_issue_tracker --issue 8675309

Note

This implementation is meant for demonstration purposes only. It uses a simple, filesystem-backed issue tracker instead of a real issue tracker like Buganizer. It also will never push CLs to Gerrit, even when asked to.

Build and run your own scanners#

To create freshness or defect scanning tools for your project, you will need to supply implementations of several stagesas as described by the implementation guides:

To run scanning tools already created for your project, check the user guides:

Defect scanner user guide

How to scan for security defects

User guide for defect scanners
Freshness scanner user guide

How to scan for stale third-party packages

User guide for freshness scanners
Other utilities

How to use other pw_fortifier utilities

Other utilities
Defect scanner implementation guide

How to build a security defect scanner

Implementation guide for defect scanners
Freshness scanner implementation guide

How to build a third-party package scanner

Implementation guide for freshness scanners
Design

Learn more about pw_fortifier’s asynchronous pipeline

Design