BuildXL/Examples/MsGuardian

MS Guardian Sample

Introduction

This sample demonstrates how to use the Guardian SDK with BuildXL. See the Guardian documentation in the BuildXL wiki for more details on the Guardian SDK, or aka.ms/msguardian for more details on the Guardian tool.

Instructions

1. Set the BUILDXL_BIN environment variable to the BuildXL deployment folder.
2. Copy the latest versions of the following directories from the BuildXL source code to the sdk directory on this sample: BuildXLRepoRoot/Public/Sdk/Public/Tools/Guardian and BuildXLRepoRoot/Public/Sdk/Public/Json.
3. Open src/Program.cs and add a CredScan violation inside the Main function. This can be as simple as adding two string variables named Username and Password and setting them to any string.
4. In powershell, run .\build.ps1.
5. This build will fail as it has a CredScan violation. To baseline the CredScan violation, uncomment the baselineFiles line within the GuardianArguments structure in GuardianSample.dsc.
6. Now create a baseline file. Look at the error that is generated by BuildXL.
   • From the error message in the console, look at the last line pointing to the stdout file.
     • Example: C:\path\to\BuildXL.Internal\Examples\MsGuardian\Out\Objects\1\e\98hj2aj7t0oy2cpptnyy4lvq\guardian.cmd.std_2\out.txt
   • Take root of the guardian.cmd.std_2 directory and append guardianOut\buildxl.gdnsettings
     • Example: C:\path\to\BuildXL.Internal\Examples\MsGuardian\Out\Objects\1\e\98hj2aj7t0oy2cpptnyy4lvq -> C:\path\to\BuildXL.Internal\Examples\MsGuardian\Out\Objects\1\e\98hj2aj7t0oy2cpptnyy4lvq\guardianOut\buildxl.gdnsettings
   • Then run the following command to create the baseline (ensure that a proper absolute paths are provided as Guardian will not accept relative paths)
     • guardian baseline --settings-file C:\path\to\BuildXL.Internal\Examples\MsGuardian\Out\Objects\1\e\98hj2aj7t0oy2cpptnyy4lvq\guardianOut\buildxl.gdnsettings -f C:\path\to\BuildXL.Internal\Examples\MsGuardian\.config\guardian\buildxl_baseline
7. Finally, run .\build.ps1 again to get a passing build.