Developer notes for OWASP Threat Dragon
This is a collection of notes used during development, most of which should be up to date - if not then raise an issue.
The recipes are for both Windows and Linux/MacOS; in general the npm
and git
commands are the same on all platforms,
but some of the commands (eg cd ../..
) need to be modified if running on a Windows platform.
The documentation repo will update documentation at both threatdragon.github.io and docs.threatdragon.org websites.
git clone --recursive [email protected]:OWASP/threat-dragon.git
cd threat-dragon
npm install
npm test
export GITHUB_CLIENT_ID=<the client id>
export GITHUB_CLIENT_SECRET=<the client secret>
export NODE_ENV=development
export SESSION_STORE=local
export SESSION_SIGNING_KEY=<32 char key>
export SESSION_ENCRYPTION_KEYS='[{"isPrimary": true, "id": 0, "value": "<32 char key>"}]'
npm start
Note that some environment variables need to be set up for the webapp to run.
Once these are in place then use npm start
to run the threat dragon server.
Navigate in a browser to http://localhost:3000/ to test the app. If there is an error such as 'Cannot GET /' then make sure the environment variables are set up correctly.
Launch the electron-based desktop application using:
git clone [email protected]:OWASP/threat-dragon.git
cd threat-dragon/td.desktop
npm install
npm run build
npm test
npm start
After making changes to code it is usually worth a npm run build
before npm run start
You can debug the changes using npm run debug
which prints debug messages to the console
A Dockerfile is provided that can be used to create a docker image:
- checkout the threat dragon source repo
- from the root directory build the docker image using
docker build -t owasp-threat-dragon:dev .
- wait for the docker image to build
- create a
.env
environment variable file using the exampleexample.env
as a template - run a docker container using
docker run -it -p 3000:3000 -v $(pwd)/.env:/app/td.server/.env owasp-threat-dragon:dev
- navigate in a browser to http://localhost:3000/
- if there is an error in the browser such as 'Cannot GET /' then make sure
.env
file is correct
The steps used during the release process
git clone [email protected]:OWASP/threat-dragon.git
cd threat-dragon
- update version declaration, eg
"version": "1.6.0",
, inpackage.json
,td.desktop/package.json
,td.site/package.json
andtd.server/package.json
- rebuild the applications using the new semver
npm install
npm run build
npm test
git commit -a -m"<some release message>"
git push
- tag the release with appropriate subver
git tag v1.6.0
git push origin v1.6.0
- once tagged the workflow pushes the docker image to docker hub
- check using
docker pull threatdragon/owasp-threat-dragon:v1.6.0
Test the release images as above; ideally on all of Windows, linux and MacOS
Ensure the Snap image is available via official snapcraft distribution
All tests going well then update the release notes for the draft release in the Threat Dragon release area and then mark the release as public
Update the release notification on the OWASP releases page
Finally ensure Threat Dragon tweets the release on Twitter, and announces it on the OWASP slack channels
These public sites are updated from Mike Goodwin's original repo at github.com/mike-goodwin/owasp-threat-dragon, so long as all the pull request checks pass.
- merges to
master
branch will update the online demo - merges to
development
branch will update the snapshot demo
Threat Dragon: making threat models less threatening