JIRA FAQ's

How to know the issues assigned to me?
Click your user name at the top-right of the page. Your 'User Profile' will be displayed.
From here click 'View Your Profile' in the left column.
Click the links under 'User Filters' in the right column to view your 'Assigned' issues, 'In Progress' issues and 'Reported' issues
Click the links under 'Assigned Open Issues per project' in the right column to view the unresolved issues (if any) that are assigned to you for each project.

How to see the list of all issues that you have created, which have not yet been resolved?
Go to the Dashboard and click the 'My Unresolved Reported Issues' link

How to change my Jira password?
Click your user name at the top-right of the page. Your 'User Profile' will be displayed.
Click 'Change Password' in the left column to change your JIRA password.
Unless you are not using Active Directory or LDAP username to login to JIRA


To view your watch-list
Click your user name at the top-right of the page. Your 'User Profile' will be displayed.
Click 'Your Watches' in the left column to view the list of issues that you are watching.


To change 'Number of Issues displayed per Issue Navigator page', 'Outgoing email format'
Click your user name at the top-right of the page. Your 'User Profile' will be displayed.
Click 'View Preferences'/'Edit Preferences' in the left column


How to attach a screenshot to an issue?
Open the JIRA issue. Click the 'Attach screenshot to this issue' link in the 'Operations' menu.
The 'Attach Screenshot' page will open in a new browser window.
Ensure that you have captured an image to your operating system's clipboard and click the 'Paste' button to paste the image.
Enter a file name and comment for the screenshot.
Click the 'Attach' button.

How to attach an image inline into a Description field? (editing rich text fields)

To include an image in the field, you would first attach the image to the issue, then type the following into the field: 
inline attachments !screenshot-1.jpg|thumbnail!


How to log work on an issue?
If time-tracking has been enabled, three coloured bars will be displayed for each issue, representing the following amounts of time: Original Estimate (blue), Remaining Estimate (orange), Time Spent (green).
Specifying an original time estimate
Navigate to the issue and edit it. Provide value to 'Original Estimation either in weeks/days/hours/minutes like 3d, 2h, 4w, etc
Logging work on an issue 
Navigate to the issue and select 'Log work done' from the 'Operations' menu on the left-hand side of the screen. 
In the 'Time Spent' field, enter the amount of time to be logged. 
In the 'Start Date' field, select the date/time when you started work. 
The 'Adjust Estimate' field affects the value of the issue's 'Remaining Estimate'.

In the 'Work Description' field, type a description about the work you have done.
Click the 'Log' button.
Editing a work log entry
Navigate to the issue and select the 'Work Log' tab (below the 'Description' field).
Click the 'Edit' link, located at the right of the work log entry. Edit the fields and Click the 'Log' button.
Deleting a work log entry
Navigate to the issue and select the 'Work Log' tab (below the 'Description' field).
Click the 'Delete' link, located at the right of the work log entry.


How to do a search for issues that are due seven days from now?
Choose "Find Issues" in the title bar to bring up the Issues Navigator.
Enter 7d into the "Due Date To" text field of the Issue Navigator.
To find all issues that are due after 1st June 2011, enter 1-6-2011 into the "Due After" field.

How to create a subtask?
Navigate to the issue and select 'Create sub-task' from the 'Operations' menu.
Choose the project and issue type. Enter the details of the issue
Click the 'Create' button

The parent issue's summary and issue key are displayed above the sub-task's summary.
Working with sub-tasks
If an issue has sub-tasks, then the issue screen will show a list of all the issue's sub-tasks.
You can reorder sub-tasks by using the up and down arrows.

You can perform actions on the sub-tasks by clicking the links in the right-most column, e.g. 'Resolve Issue', 'Close Issue', 'Reopen Issue'.
If time-tracking is enabled, colored bars will be displayed showing the aggregate 'Original Estimate', 'Remaining Estimate' and 'Time Spent' for all of the issue's sub-tasks.
Searching for sub-tasks
When sub-tasks are enabled, two extra entries will appear in the 'Issue Type' drop-down list in the
Issue Navigator's search form. These entries are: 'Standard Issue Types' and 'Sub-Task Issue Types'.
Converting a standard issue to a sub-task
Navigate to the issue and select 'Convert to sub-task' from the 'Operations' menu
Select Parent Issue and Sub-Task Type
Update Fields and click the 'Finish' button
The issue will be displayed. You will see that it is now a sub-task, that is, its parent's issue number is now displayed at the top of the screen

Converting a sub-task to a standard issue
Navigate to the sub-task issue and select 'Convert to issue' from the 'Operations' menu.
Select New Status and Update Fields. 
Click the 'Finish' button. The issue will be displayed. You will see that it is no longer a sub-task, that is, there is no longer a parent issue number displayed at the top of the screen.


How to create Voter and Watcher Lists?
JIRA allows a user to cast a vote for a particular issue - "voicing" their preference for that issue to be resolved or completed. JIRA also allows a user to watch a particular issue, signing up for notifications of any updates relating to that issue.
Watcher list
Navigate to issue -> More Actions -> Watchers -> Add users to Watch list -> Add.
Stop watching.
Navigate to issue -> More Actions -> Stop Watching.


How to create a link between issues?
Issue linking allows you to create an association between issues. For example: an issue may duplicate another or an issue may depend on another
Navigate to issue and click the word 'Link' under the Operations menu or "More Actions" (in newer version).

The 'Link Issue' form will be displayed. Select the type of link to be created, and the issue(s) to be linked to.
To delete a link
Inside a linked issue, click on the 'Manage Links' link (*  button in newer version).

In the following screen, click on the small trashcan icon in the bottom-right corner.

How to clone an issue?

Clone Issue allows a user to create a duplicate of an issue within the same project.
The clone issue is a replica of the original issue - containing the same information stored in the original issue - e.g.summary, affects versions, components, etc.

A clone issue is a separate entity from the original issue. Operations on the original issue have no affect on the clone issue and vice versa.

Navigate to issue and click the word 'clone' under the Operations menu or "More Actions" menu (in newer version).
Clone Issue Linking
The clone issue can be linked to the original issue when creating the clone issue.
Cloning and Sub-Tasks
Sub-Tasks can be cloned in the same manner. If the original issue has associated sub-tasks, clone sub-tasks will also be created for the clone issue.

How to move an issue from one project to another?

As there may be significant differences in the configuration of your original project and target project, the 'Move Issue' wizard allows you to change certain attributes of the issue. These include: Issue Type (if any custom type defined), Issue Status, Custom Fields.


Navigate to issue and click the word 'move' under the Operations menu or "More Actions" menu (in newer version).

The first page 'Move Issue' wizard will display. Select the project that you wish to move your issue to, and if required, change the issue type. Click 'Next'.
If you are required to change the status of your issue the 'Select Status' page will display. Select the new status for your issue and click 'Next'.
If you are required to specify the values for any required custom fields the 'Update Fields' page will display. Specify the desired values for each field, and click 'Next'.
The 'Confirmation' page will display with all of your changes.
click 'Move'


How to perform bulk operations?

From the Issue Navigator, perform a search with the required filters to produce an issue result set.
The Bulk Change option in the Issue Navigator menu provides access to the bulk operations. The Bulk Change link is only available to users who have been granted the global Bulk Change permission.
The next screen allows the selection of the issues that the bulk operation is to be performed on.

The next screen allows the bulk operation to be selected - Workflow Transition, Delete, Move or Edit. Select the operations and follow corresponding actions to complete the bulk operation.
It is possible to disable mail notification for a particular bulk operation by de-selecting the "Send Notification" checkbox in the bulk operation wizard.

Read More

A look around Jira concepts

Jira is a issue management tool.

What issue means to Jira?
    Bug, Project task, help-desk ticket, a leave request form.

Issue types
  Default
    - Bug
    - Improvement
    - New Feature
    - Task
    - or custom issue defined by admin

Issue statuses
  General: Open  -> Resolved  -> Closed
  Open
  In progress
  Resolved
  Reopened
  Closed

Issue Resolution types
  Fixed
  Won't fix
  Duplicate
  Incomplete
  Cannot Reproduce

Issue Priority types
  Blocker   (Highest)             P0
  Critical                               P1
  Major                                P2
  Minor                                P3
  Trivial

Project
  - S/w development project, marketing campaign, help-desk system, leave request management system
  - It will have a name and a KEY
  - Issue Key = Project Key-###  
     where ### is issue number
               
                 Projects
                      |
         ------------------------                              --------- Released
        |                                    |                 States   |
  Components                 Versions ----- --------- |----------- unreleased
                                            |                              | 
                                                                           ----------- Archived  
                                            |                            
                   -----------------------------------     
                  |                                            |
         Affects version                         Fix version
                                                               | No fix version
                                                        unscheduled

Read More

Developing packages with RPM

Reference: Max RPM book, Edward C. Bailey

Building a package is similar to compiling code—there are inputs, an engine, and outputs.

Inputs

1) Sources - It should be a tar file. RPM can handle other archive formats, but a bit more up-front effort is required.
2) Patches - RPM gives you the ability to automatically apply patches.
3) Spec File - It contains information required by RPM to build the package, as well as instructions telling RPM how to build it. It also dictates exactly what files are a part of the package, and where they should be installed. There are eight sections in spec file
  3.1 - The Preamble  - It contains information that will be displayed when users request information about the package. This would include a description of the package’s function, the version number of the software, and so on.
  3.2 - The Prep Section - necessary preparations are made prior to the actual building of the software. The contents of this section are an ordinary shell script. However, RPM does provide two macros. One macro can unpack a compressed tar file and cd into the source directory. The other macro easily applies patches to the unpacked sources.
  3.3 - The Build Section - The build section consists of a shell script. It is used to perform whatever commands are required to compile the sources. This section could consist of a single make command, or be more complex if the build process requires it.
  3.4 - The Install Section - It also consists of a shell script. It is used to perform the commands required to install the software. This section might only consist of a make install command. Otherwise, the usual assortment of cp, mv, or install commands to get the job done.
  3.5 - Install and Uninstall Scripts - It consists of scripts that will be run, on the user’s system, when the package is actually installed or removed.
  3.6 - The Verify Script - It is executed when RPM verifies the package’s proper installation. While RPM does most of the work verifying packages, this script can be used to verify aspects of the package that are beyond RPM’s capabilities.
  3.7 - The Clean Section - contains a script that can clean things up after the build. This script is rarely used, since RPM normally does a good job of clean-up in most build environments.
  3.8 - The File List - The last section consists of a list of files that will comprise the package. Additionally,
a number of macros can be used to control file attributes when installed, as well as to denote which files are documentation, and which contain configuration information. The file list is very important — if it is missing, no package will be built.

Engine: RPM
It performs a number of steps during the build process:
  *) Executes the commands and macros in the prep section of the spec file.

  *) Checks the contents of the file list.
  *) Executes the commands and macros in the build section of the spec file.
  *) Executes the commands and macros in the install section of the spec file. Any macros in the file list are executed at this time, too.
  *) Creates the binary package file.
  *) Creates the source package file.

 Outputs

 The end product of this entire process is a source package file and a binary package file.
  1) Source package: It is a specially formatted archive that contains the following files - the original compressed tar file(s), spec file, patches. It is a great way to archive all the information needed to rebuild a particular version of the package.
  2) Binary RPM: It contains the files that comprise the application, along with any additional information needed to install and erase it.

Building packages

Step 1: Creating the Build Directory Structure

  Default directory layout consists of a single top-level directory (/usr/src/redhat) with five subdirectories.
  /usr/src/redhat/
        SOURCES  -  Contains the original sources, patches, and icon files.
        SPECS - Contains the spec files used to control the build process.
        BUILD - The directory in which the sources are unpacked, and the software is built.
        RPMS - Contains the binary package files created by the build process.
        SRPMS - Contains the source package files created by the build process.

Read More

Fortify scan automation steps for analyzing c/c++ code (Makefiles)

I wrote in my previous blog about installing and configuring Fortify client. This blog presents standard steps to automate fortify scan for c/c++ code which are compiled using Makefiles.

Step 1: Compile your source code by instrumenting Fortify
      Normally we compile source code using  compilers like cc, gcc, cl.exe or devenv. To instrument fortify append sourceanalyzer (fortify tool) to your compilation command at the beginning.
     For ex: sourceanalyzer -b testing-fortify cc test.c

     This command will compile test.c and generates NST file, which is understood by Fortify tool.
      Note: .nst files can be located at $HOME/.fortify 

     In most cases we don't compile individual files like it shown above. We will be using Makefiles to manage compilation. In that case we need to inform Make to call sourceanalyzer at the time compilation.
    If our Makefiles (usually top level makefiles) have defined the CC variable, then we can modify it as given below
    ifdef FORTIFY
        CC="sourceanalyzer -b MyProject $CC"
    endif

    With this definition, your Make command will be able to compile all your source files using sourceanalyzer.

Step 2: Scan NST files to generate fpr file
    Fortify generates a fpr file using the NST files generated in step 1. Once all your files are compiled in step 1, you need to run this step only once to generate one combined FPR file. This FPR file will be understood by other fortify tools used for reporting.

   sourceanalyzer -b MyProject -scan -f MyProject.fpr

  This will generate a FPR file named myproject.fpr which will be used in next steps.

Step 3: Upload the FPR file to Fortify 360 server
   Fortify 360 server is web based tool, which displays fortify scan result. The input to this tool is the FPR file which we generated in Step 2.
   We can upload the FPR file to Fortify 360 server using the command given below

    fortifyclient -url http://my-fortify-360-server:8282/f360 -authtoken afknafowqnewksdgjsgddkg  uploadFPR -file MyProject.fpr -project MyProject  -version 1.0

  where for
      -authtoken : You need to generate authentication token for login to Fortify 360 server. Refer my previous blog to know how to generate it
      -project: You need to create your project name in your Fortify 360 server, prior to this step.
      -version: You need to create your project version in your Fortify 360 server, prior to this step.

Step 4: Generating PDF report using the FPR file
   You can generate a PDF or XML report out of FPR file, which can be sent through mail for developers.
   Here is the command to do it
    ReportGenerator -format pdf -f MyProject.pdf -source MyProject.fpr

    Refer my previous blog for detailed information about this step.

 This completes the automation steps for Fortify scan on c/c++ code.


Note: You can use an application called auditworkbench to analyze fortify scan report. Even input for auditworkbench is FPR file.

Some more useful commands
 - Use sourceanalyzer -b MyProject -show-files to know what all files are associated with the tag MyProject
 - Use sourceanalyzer -b MyProject -show-build-warnings to show errors and warnings
 - Use sourceanalyzer -b MyProject -show-loc to show Lines of code. 

Read More

Perforce streams - a new feature in Perforce (not yet released)

Perforce is coming up with a new feature called "streams". Not mentioned when it will be released. But they are promoting that, this feature will enhances branch management and reduces merge issues.

What is a stream?

                A stream describes about branch like depot location, owner, it's parent branch and more. It is a branching and merging application based on the perforce system.

Notable features:

·         Streams provide a centralized control to manage project related workspaces. Just setup one stream view and link your workspace to that stream.

                Whenever stream view changes, it automatically update workspace views.

·         Streams can be used to compute sensible defaults for merges
·         P4V is being enhanced to show streams in a slick visual flowchart, and to offer a simple interface for sophisticated stream tasks.

The current available details about this feature can be obtained from these links

http://blog.perforce.com/blog/?p=2948

&

http://blog.perforce.com/blog/?p=2951
and
Streams a Tiny tutorial

Read More

Installing and configuring Fortify on Linux and Windows machines

Installing Fortify on Linux (RHEL 5 32 bit)

• Download Fortify archive Fortify-360-2.6.5-Analyzers_and_Apps-Linux-x86.tar.gz and extract it to a directory like /usr/local/fortify
• Get License file fortify.license and place it under root directory (/usr/local/fortify)
• Run utility scapostinstall under bin directory (/usr/local/fortify/bin) to perform some necessary post install activities.

        ./scapostinstall

           [1] Migration...
           [2] Settings...
           [s] Display all settings
           [q] Exit
           Please select the desired action (1,2,s,q):

          Give valid entries for  Rulepack Update and 360 Server Settings

          Select 2 and proceed for changing settings. In Rulepack Update, give http address of your fortify 360 server for  Update Server URL: field. In 360 Server Settings, give again http address of your fortify 360 server for Server URL: field and set Get Rulepack Updates from 360 Server: true

• Now update rules pack using tool rulepackupdate available at bin directory (/usr/local/fortify/bin) 
• Generate Upload access token using utility fortifyclient under bin directory. The upload access token enable account and password information to be concealed during uploading of FPRs to Fortify 360 Server          

          fortifyclient -url [360_server_URL] token -gettoken AnalysisUploadToken -user [AccountName]
 
          fortifyclient prompts for a password, type the password for [AccountName]. fortifyclient displays a token of the general form cb79c492-0a78-44e3-b26c-65c14df52e86. Copy the token returned by fortifyclient into a text file.

Updating rules in future

• In case in future if you want to update rule packs, here is the process
• You may get rules pack in a zip file of the form Se289787b-abd8-4ad6-a77d-f11d89e8ac60.zip 

          Then run the command
         /usr/local/fortify//bin/rulepackupdate -import Se289787b-abd8-4ad6-a77d-f11d89e8ac60.zip

• or if your F360 server is up to date with rules, then run the command

           /usr/local/fortify//bin/rulepackupdate -url  [360_server_URL]

Read More

Fortify report templates using ReportGenerator

Fortify Static Code Analysis Tool allows us to create scan reports using command line utility ReportGenerator.

By default ReportGenerator creates report using the template OWASP2007.xml

Here is an example of generating PDF scan report using command line utility

ReportGenerator -format pdf -f outputFile.pdf -source dev-rkm-KMS-aggregate.fpr

We can create report either in pdf or rtf or xml.

Some times we get an error like

Xlib: connection to "localhost:10.0" refused by server
Xlib: PuTTY X11 proxy: wrong authentication protocol attempted

It means ReportGenerator will open Xwindows and your server doesn't have any Xserver running. You can try to run some simple X applications like xcalc or xterm on your machine and make sure Xserver is running fine.

But there is also an option -template, using which we can generate reports of various formats.This option is not well documented. When you say "ReportGenerator -help", it just says

-template       The Fortify Report template used to define the report.

But what are the various available template names, which they are not giving information.

Anyways still we can find out available templates in the directory fortify-install-dir/Core/config/reports

Available templates are

1) DefaultReportDefinition.xml  

2) DeveloperWorkbook.xml 

3) OWASP2004.xml  

4) OWASP2007.xml  

5) ScanReport.xml

Here is an example of using template option

ReportGenerator -format pdf -f outputFile.pdf -source dev-rkm-KMS-aggregate.fpr -template "ScanReport.xml"

Read More