Fortify Project Results (FPR) file compatibility

OpenText Application Security Software products support opening and uploading FPR files in adjacent releases. OpenText Application Security Software products can open and accept for upload:

  • FPR files that have the same version (<year>.<quarter> portion of the version)

  • Older FPR files (within the Product Support Lifecycle policy)

    For example, Fortify Audit Workbench version 25.4.0 can open version 24.2.0 FPR files.

  • FPR files that are one version later

    For example, you can upload version 25.4.0 FPR files to Application Security version 24.4.0. Fortify Audit Workbench version 24.4.0 can open version 25.4.0 FPR files.

    OpenText Application Security Software products do not support opening and uploading FPR files generated by later versions of OpenText Application Security Software products when the versions are more than one version apart. For example, uploading a version 25.4.0 FPR to Application Security version 24.2.0 and opening a version 24.2.0 FPR file in Fortify Audit Workbench is not supported.

OpenText recommends that you keep your OpenText Application Security Software product versions synchronized so that you are working with FPR file versions that have the same version as your products.

The FPR file version is determined as follows:

  • The FPR version is the same version of the analyzer that generated it. For example, an FPR generated by OpenText SAST version 25.4.0 also has version 25.4.0.
  • The FPR version is the same version of Application Security or OpenText Application Security Tools that changed or audited the FPR.
  • If you merge two FPRs, the resulting FPR has the version of the more recently generated FPR. For example, if you merge a version 24.2.0 FPR with a version 25.4.0 FPR, the resulting FPR has the version 25.4.0.

Caution regarding uploading FPR files to Application Security

Application Security Center keeps an FPR file that contains the latest scan results and audit information for each application. Fortify Audit Workbench and the Secure Code Plugins also use this FPR file for collaborative auditing.

Each time you upload an FPR to Application Security, it is merged with the existing FPR. If the FPR has a later version number than the existing FPR, the existing FPR version changes to match the newest FPR.