Fortify Application Security provides your team with solutions to empower DevSecOps practices, enable cloud transformation , and secure your software supply chain . As the sole Code Security solution with over two decades of expertise and acknowledged as a market leader by all major analysts, Fortify delivers the most adaptable, precise, and scalable AppSec platform available, supporting the breadth of tech you use and integrated into your preferred toolchain. We firmly believe that your great code demands great security , and with Fortify, go beyond 'check the box' security to achieve that.
The Fortify CI Tools image is primarily meant for demonstration and testing purposes, allowing easy integration of Fortify application security testing into DevSecOps pipelines that use configurable runners to execute CI/CD workflows. The primary focus is on scanning Java applications; the image lacks build tools for other languages. For production usage, it's better to utilize fcli for interacting with the various Fortify products and for setting up other Fortify tools like ScanCentral Client. This allows for the existing build environment to be used while packaging your source code, potentially resulting in less errors & warnings and better scan results.
Image versions 1.x.x are tagged with the full version number only
Starting with version 2.0.0, images are tagged as <major>.<minor>.<patch>, <major>.<minor>, and <major>
Allows users to select the latest minor and/or patch version in a <major> or <major>.<minor> version range
Starting with version 2.2.0, multiple JDK versions are available:
Identified by the -jdk-8, -jdk-11, -jdk-17 and -jdk-21 tag suffixes
Older image versions may not provide -jdk-17 and/or -jdk-21 variants
Any 2.x.x tags that do not specify the JDK version correspond to the JDK 8 images
Any 3+ tags that do not specify the JDK version correspond to the JDK 11 images
fcli [options]scancentral [options]FoDUpload [options]FortifyVulnerabilityExporter [options]
Update base image to Ubuntu 26.04
Update fcli to 3.20.0
Update ScanCentral Client to 26.2.0
Update Maven to 3.9.16
Apply latest Java patches
Update fcli to 3.18.0
Update Maven to 3.9.15
Update fcli to 3.15.0
Update Maven to 3.9.13
Apply latest Java patches
Update fcli to 3.13.1
Update ScanCentral Client to 25.4.0
Apply latest Java patches
Remove Gradle as most projects will use Gradle Wrapper anyway
Update fcli to 3.8.1
Update FoDUploader to 5.4.3
Update Maven to 3.9.11
Apply latest Java patches
Update fcli to 3.6.0
Update ScanCentral Client to 25.2.0
Update Gradle to 8.14.2
Update Maven to 3.9.10
Update fcli to 3.4.1
Update Gradle to 8.14
Update Java to latest patch release
Update fcli to 2.12.2
Update ScanCentral Client to 24.4.1
Update fcli to 2.9.0
Update ScanCentral Client to 24.4.0
Update Gradle to 8.10
Update Ubuntu base image to 24.04
Update fcli to 2.8.0
Update Java to latest patch versions
Update fcli to 2.7.1
Update Gradle to 8.6
Update Maven to 3.9.9
Update Java to latest patch versions
Update FortifyVulnerabilityExporter to 2.1.0
Add Java 17 (required by ScanCentral Client 24.2+) to jdk-11 image
Update fcli to 2.4.0
Update ScanCentral Client to 24.2.0
Fix sast-scan.sh to remove superfluous quotes that were causing FoD authentication errors on FoDUploader 5.4.1
Apply latest available OS patches
Fix for JDK8 image: Move Java installation used by ScanCentral Client to other directory, to avoid this Java instance from being removed when removing/upgrading/downgrading ScanCentral Client.
Add JDK 21 image
Apply latest available OS patches
Update FoDUploader to 5.4.1
Update JDK 8/11/17 to latest patch release
Apply latest available OS patches
Update fcli to 2.3.0
Update FortifyVulnerabilityExporter to 2.0.5
Update JDK 8/11/17 to latest patch release
Apply latest available OS patches
Update fcli to 2.2.0
Update ScanCentral Client to 23.2.1
Update Maven to 3.9.6
Update fcli to 2.0.0 (changes in fcli command structure may require pipelines/automations using fcli commands to be updated)
Update Maven to 3.9.5
Update Gradle to 8.3 (note that this version is not officially supported by the ScanCentral Client version contained in this image)
Update fcli to 1.3.2
Update FortifyVulnerabilityExporter to 2.0.4
Update fcli to 1.3.1
Update FortifyVulnerabilityExporter to 2.0.3
Update ScanCentral Client to 23.1.0
Major internal refactoring. please contact Fortify Support in case of issues with this refactored image
Update ScanCentral Client to 22.2.1 for jdk-8 images, now having the same ScanCentral Client version in all image variants
Add jdk-17 image
Update fcli to 1.2.5
Update FortifyVulnerabilityExporter to 2.0.2
Rearrange apt-get statements to potentially apply more updates
Update fcli to 1.2.4
Update FortifyVulnerabilityExporter to 2.0.1
Update fcli to 1.2.3
Update Gradle to 8.0.2 (note that this version is not officially supported by the ScanCentral Client version contained in this image)
Update Maven to 3.8.8
Downgrade Maven to 3.8.7 to fix potential incompatibility with ScanCentral Client
Update fcli to 1.2.2
Update Gradle to 7.6.1
Update ScanCentral Client to 22.2.1
Apply (security) updates on top of base image
Apply Docker best practice to run apt-get update and install in single RUN instruction (move 'install unzip' instruction to better location, don't uninstall unzip as it may be useful for users)
Update fcli to 1.2.0
Update FortifyVulnerabilityExporter to 2.0.0
Update Maven to 3.9.0
Update fcli to 1.0.3
Update Gradle to 7.6
Update Maven to 3.8.7
Update ScanCentral Client to 22.2.0
Update ScanCentral Client to 22.1.2
Update FortifyVulnerabilityExporter to 1.8.0
Update FortifyVulnerabilityExporter to 1.7.0
Update FoDUploader to 5.4.0
Update FortifyVulnerabilityExporter to 1.6.0
Update Gradle to 7.5.1
Update FoDUploader to 5.3.1
Update Maven to 3.8.6
Update ScanCentral Client to 22.1.0
Update FortifyVulnerabilityExporter to 1.5.5
Update Gradle to 7.4.2
Update Maven to 3.8.5
Add SCANCENTRAL_AUTH_TOKEN option
Update FortifyVulnerabilityExporter to 1.5.3
Update FortifyVulnerabilityExporter to 1.5.4
Update Gradle to 7.3.3
Update ScanCentral Client to 21.1.4 (Java 8 image)
Update ScanCentral Client to 21.2.3 (Java 11 image)
Update FortifyToolsInstaller to version 2.5.0
Update ScanCentral Client to version 21.1.3 (Java 8 image)
Update ScanCentral Client to version 21.2.2 (Java 11 image)
Update FoD Uploader to version 5.3.0
Update FortifyToolsInstaller to version 2.1.0
Update FortifyVulnerabilityExporter to version 1.5.1 (with updated log4j dependency)
Update Gradle to version 7.3.1
Update Maven to version 3.8.4
Update ScanCentral Client to version 21.2.0 (Java 11 image only)
Re-add plain 'latest' tag for fortify-ci-tools
Update Maven to 3.8.3 to fix URL not found error
BitBucket Pipe repository update
BitBucket Pipe repository update
Check sha256sum for FortifyToolsInstaller.sh
Use FortifyToolsInstaller 2.1.0 to check sha256sum for downloaded Fortify tools
BitBucket Pipe repository update
Auto-publish BitBucket Pipe repository
Build fortify-bitbucket-pipe image
sast-scan.sh fixes & updates
Rebuild to benefit from base image vulnerability fixes
FoDUploader: Add FoDUpload shell script for easy invocation
FortifyVulnerabilityExporter: Moved, updated and renamed fve shell script to FortifyVulnerabilityExporter shell script
Image tags without JDK version are no longer available
Removed most environment variables like FOD_UPLOAD and FVE_JAR, as they are no longer needed when invoking the appropriate shell scripts
Replace deprecated adoptopenjdk base image by eclipse-temurin
Use bash shell for JDK 11 image for compatibility with JDK 8 image
Provide both JDK 8 and JDK 11 images
Update to FortifyVulnerabilityExporter 1.5.0
Update to Gradle 7.2
Update to Maven 3.8.2
Update to ScanCentral Client 21.1.2
Update to FortifyVulnerabilityExporter v1.4.1
Add FortifyVulnerabilityExporter
Update base image to adoptopenjdk:8-jdk
Update to Gradle 7.0
Update to Maven 3.8.1