As requested by many attendees, you can download the slides right now. If you already have Jenkins (or Hudson) up and running, you might want to give it a try. The Insight for CI plugin is available in the plugin center and trivial to install and configure. Just add a post build step and configure it to scan e.g. your build output war file. The summary and component results are completely free and will give you a very good indication of the security and license issues (or better their absence) of your software. If you are using a different CI server, you should let us know so we can adjust our priorities. And we even got you covered for manual scans – have a try with Insight App Health Check.

A big thanks to all of you who registered and attended our Insight for CI Demo last week. We had a great turnout and a lot of fantastic questions! If you didn’t have a chance to register, that doesn’t mean you have to miss out. The replay is now available.

Request the webinar recording here.

Ready to try Insight for CI for yourself? Let us help you get started.

Thank you!

“Nearly two-thirds of security leaders say their senior executives are paying more attention to security today than they were two years ago, due in large part to media attention.” and “60 percent of the advanced organizations named security as a regular boardroom topic, compared to only 22 percent of the least advanced organizations”

Instead of simple three-tiered applications following a standard Apache -> Tomcat -> RDBMS pattern, today’s scaleable applications involve a portfolio of technologies: Redis, Hadoop, real-time BI systems, integration with 3rd party APIs, Node.js, with more and more companies adopting a portfolio of technologies. It is becoming increasingly difficult to draw a line around a particular application and evaluate security vulnerabilities in isolation.

Today, you need to have your security group sitting next to you evaluating a complex application as it evolves…. but, back to the article, it isn’t just the evolution of technology that is making security a focus for business, it is a series of high-profile, embarrassing data breaches. A CEO that wouldn’t have thought very much about security technology a few years ago, sees what happens to a Stratfor or Global Payments and they understand the risks. Data security is front and center in the news, and a data breach can be a business-ending event.

So get out in front the problem. Start tracking your application dependencies and identify known vulnerabilities with Insight.

When we launched Nexus Professional and integrated Sonatype Insight information we gave you the ability to keep track of your overall exposure to security vulnerabilities. Your IT organization gained a window into the intersection of known vulnerabilities with the artifacts you download from Central. That was a good start, but the real benefit is Insight for CI. We launched Insight for CI this week, and it’s the tool you’ll want to use to address security vulnerabilities in specific products. If it is your responsibility to keep up with security, one of the easiest ways to take a more proactive approach is to start using Insight for CI to track your application’s dependencies.

Click here to get started with Insight for CI. It works with either Hudson or Jenkins, and it covers both license and security information.

Join Brian Fox tomorrow, Wednesday, May 23 at 11AM EDT or 2PM EDT (GMT-0400) for a 30 minute tour of Insight for CI. In this demo, Brian will show how Insight for CI will help you:

• Generate a detailed bill of materials for every build in Hudson and Jenkins.
• Find and fix license, security and quality problems quickly.
• Set rules to notify you of problems, fail builds, or establish workflows.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Two sessions are available tomorrow, Wednesday, May 23. Choose the best time for you:

Register – 11:00AM EDT (GMT-0400)

Register – 2:00PM EDT (GMT-0400)

Due to high demand, we have added a second webinar presentation next Wednesday at 2PM EDT (GMT-0400) to accommodate multiple time zones. Here are the details for the presentation:

Join Brian Fox this Wednesday, May 23 at 11AM EDT or 2PM EDT (GMT-0400) for a 30 minute tour of Insight for CI. In this demo, Brian will show how Insight for CI will help you:

• Generate a detailed bill of materials for every build in Hudson and Jenkins.
• Find and fix license, security and quality problems quickly.
• Set rules to notify you of problems, fail builds, or establish workflows.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Two sessions are now available on Wednesday, May 23. Choose the best time for you:

Register – 11:00AM EDT (GMT-0400)

Register – 2:00PM EDT (GMT-0400)

• Gain visibility and control at build time in Hudson and Jenkins.
• Find and fix license, security and quality problems quickly.
• Set rules to notify you of problems or to fail builds.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Reserve Your Seat Here

A big thanks to all of you who registered and attended our sneak preview of Insight for CI last week. We had a great turnout and a lot of fantastic questions! If you didn’t have a chance to register, that doesn’t mean you have to miss out. The replay is now available.

Request the webinar recording here.

Thank you!

Know What’s In Your Builds?

Join Brian Fox tomorrow, Thursday, May 3 at 11AM EDT (GMT-0400) for a 30 minute sneak preview of our latest innovation, Insight for CI. Brian will show you how Insight for CI will help you:

• Gain visibility and control at build time in Hudson and Jenkins.
• Find and fix license, security and quality problems quickly.
• Set rules to notify you of problems, fail builds, or establish workflows.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Reserve Your Seat

The goal of the Hudson book is to be the authoritative source of documentation for Hudson users. We expect it to be available soon. Stay tuned to this blog for updates on the availability of the Hudson book.

For the perspective of one of the key contributors to the project, see Manfred Moser’s recent blog post, “Hudson – Book, Changes, and Community.“

Since the [Hudson] project lives on github it is pretty easy to follow the usual clone, branch, hack, commit, pull request sort of flow and thanks to Maven the build is as easy as .. surprise .. mvn clean install.

Read more of Manfred’s blog on Simpligility.

Earlier this year Sonatype and Oracle sponsored a Hudson user survey to gather input from the community about the future of Hudson.  We want to thank everyone who participated (over 1200 people from a variety of industries) as this type of survey is extremely valuable to our product team.  The survey was a huge success in that regard as it clearly points out both the popularity of Hudson as well as some key areas for improvement.

One of the most striking findings is that while our earlier Software Development Infrastructure Survey showed that Hudson is the clear Java CI market leader (over 70% of those using CI), the vast majority consider “stability” and “performance” to be the most critical “features” that need to be added (see figure 1).  This feedback rings true to us as Hudson runs at the core of our development efforts, supporting our work on Apache Maven, Nexus, Guice, and other core open source and proprietary work.  The product works well, but we have identified and solved a number of bugs that can cause performance and stability problems in Hudson. This experience seems to match closely that of Hudson users, both as indicated by the survey and through direct discussions and feedback. That is why our development team, in cooperation with Oracle and the larger Hudson developer community,  has spent a lot of time working on performance and stability improvements and has donated those improvements back to the open source Hudson project (soon to be at the Eclipse Foundation) for all to benefit.

Some of the other findings from the survey were also quite interesting, including:

• Open source development tools are widely used by over 75% of the respondents. This illustrates the success of such tools as Hudson, Maven, and Nexus.
• As shown in figures 2 and 3, the number of Master and Slave servers used with Hudson varies widely, with the number roughly correlating to organization size.  Surprisingly though, quite a few large organizations are only utilizing a few servers and missing the performance gains that are possible with a large-scale master/slave architecture.
• Only 8 plugins out of 29  were considered to be important by a majority, led by Subversion and Maven.  This was a surprising result considering the huge importance of plugins to the Hudson community.  See figure 4 for the full list.

Finally, when asked what additional features either the respondent or their boss would like to see added to Hudson, many wrote that they’d like to have commercial support available for the product.  Sonatype, responding to this need, now offers Sonatype Pro for Hudson, a fully supporting version of Hudson backed by the same engineering team that’s been making improvements to the open source project. Find out more about this product at http://www.sonatype.com/Hudson.

You can view the full survey results here.

Figure 2. Master server usage by organization size

Figure 3. Slave server usage by organization size

Figure 4. % rating plug-ins as critical or important