fortifyupdate command-line options

The following table describes the fortifyupdate options.

fortifyupdate optionDescription
-acceptKey

Specifies to accept the public key. When this is specified, you are not prompted to provide a public key. Use this option to accept the public key if you update OpenText Application Security Content from a non-standard location with the -url option.

-acceptSSLCertificateSpecifies to use the SSL certificate provided by the server.
-import <file>.zip

Imports the ZIP file that contains security content. By default, Rulepacks are imported into the <sast_install_dir>/Core/config/rules directory.

-coreDir <dir>

Specifies a core directory where fortifyupdate stores the update. If this is not specified, the fortifyupdate performs the update in the <sast_install_dir>.

Make sure that you copy the contents of the <sast_install_dir>/config/keys folder and paste it to a config/keys folder in this directory before you run fortifyupdate.

-includeMetadataSpecifies to only update external metadata.
-includeRulesSpecifies to only update Rulepacks.
-locale <locale>

Specifies a locale. English is the default if no security content exists for the specified locale. The valid values are:

  • en (English)

  • es (Spanish)

  • ja (Japanese)

  • ko (Korean)

  • pt_BR (Brazilian Portuguese)

  • zh_CN (Simplified Chinese)

  • zh_TW (Traditional Chinese)

The values are not case-sensitive.

Alternatively, you can specify a default locale for security content updates in the fortify.properties configuration file. For more information, see the OpenText™ Application Security Tools Guide.

-proxyhost <host>Specifies a proxy server network name or IP address.
-proxyport <port>Specifies a proxy server port number.
-proxyUsername
<username>
Specifies a user name if the proxy server requires authentication.
-proxyPassword
<password>
Specifies the password if the proxy server requires authentication.
-showInstalledRules

Displays the currently installed Rulepacks including any custom rules and custom metadata.

-showInstalledExternalMetadataDisplays the currently installed external metadata.
-url <url>

Specifies a URL from which to download the security content. The default URL is https://update.fortify.com or the value set for the rulepackupdate.server property in the server.properties configuration file.

For more information about the server.properties configuration file, see the OpenText™ Application Security Tools Guide.

You can download the security content from a Application Security server by providing a Application Security URL.

Specify one of the following types of credentials if you update security content from Application Security with the -url option:

-sscUsername

-sscPassword

Specifies a Application Security user account by user name and password.

-sscAuthToken

Specifies a Application Security authentication token of type UnifiedLoginToken, CIToken, or ToolsConnectToken.