Skip to content

Commit eca6572

Browse files
tdrueztdruez
committed
Merge branch 'main' into 222-product-scans
2 parents 8a6169d + d4aa383 commit eca6572

File tree

7 files changed

+222
-42
lines changed

7 files changed

+222
-42
lines changed

‎Dockerfile‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,23 @@ LABEL org.opencontainers.image.source="https://github.com/aboutcode-org/dejacode
1212
LABEL org.opencontainers.image.description="DejaCode"
1313
LABEL org.opencontainers.image.licenses="AGPL-3.0-only"
1414

15-
ENV APP_NAME dejacode
16-
ENV APP_USER app
17-
ENV APP_DIR /opt/$APP_NAME
18-
ENV VENV_LOCATION /opt/$APP_NAME/.venv
15+
# Set default values for APP_UID and APP_GID at build-time
16+
ARG APP_UID=1000
17+
ARG APP_GID=1000
18+
19+
ENV APP_NAME=dejacode
20+
ENV APP_USER=app
21+
ENV APP_UID=${APP_UID}
22+
ENV APP_GID=${APP_GID}
23+
ENV APP_DIR=/opt/$APP_NAME
24+
ENV VENV_LOCATION=/opt/$APP_NAME/.venv
1925

2026
# Force Python unbuffered stdout and stderr (they are flushed to terminal immediately)
21-
ENV PYTHONUNBUFFERED 1
27+
ENV PYTHONUNBUFFERED=1
2228
# Do not write Python .pyc files
23-
ENV PYTHONDONTWRITEBYTECODE 1
29+
ENV PYTHONDONTWRITEBYTECODE=1
2430
# Add the app dir in the Python path for entry points availability
25-
ENV PYTHONPATH $PYTHONPATH:$APP_DIR
31+
ENV PYTHONPATH=$PYTHONPATH:$APP_DIR
2632

2733
# OS requirements
2834
RUN apt-get update \
@@ -36,9 +42,9 @@ RUN apt-get update \
3642
&& apt-get clean \
3743
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
3844

39-
# Create the APP_USER group, user, and directory with proper permissions
40-
RUN addgroup --system $APP_USER \
41-
&& adduser --system --group --home=$APP_DIR $APP_USER \
45+
# Create the APP_USER group, user, and directory with specific UID and GID
46+
RUN groupadd --gid $APP_GID --system $APP_USER \
47+
&& useradd --uid $APP_UID --gid $APP_GID --home-dir $APP_DIR --system --create-home $APP_USER \
4248
&& chown $APP_USER:$APP_USER $APP_DIR \
4349
&& mkdir -p /var/$APP_NAME \
4450
&& chown $APP_USER:$APP_USER /var/$APP_NAME
@@ -53,7 +59,7 @@ RUN mkdir -p /var/$APP_NAME/static/ /var/$APP_NAME/media/
5359
# Create the virtualenv
5460
RUN python -m venv $VENV_LOCATION
5561
# Enable the virtualenv, similar effect as "source activate"
56-
ENV PATH $VENV_LOCATION/bin:$PATH
62+
ENV PATH=$VENV_LOCATION/bin:$PATH
5763

5864
# Install the dependencies before the codebase COPY for proper Docker layer caching
5965
COPY --chown=$APP_USER:$APP_USER setup.cfg setup.py $APP_DIR/

‎dejacode/static/css/dejacode_bootstrap.css‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -693,6 +693,19 @@ a[data-category-pk]:focus,
693693
body.signup-form {
694694
background-color: var(--bs-djc-blue-bg);
695695
}
696+
body.signup-form .nav-link {
697+
color: white;
698+
}
699+
body.signup-form .nav-link.active {
700+
color: white;
701+
background-color: var(--bs-djc-blue-bg);
702+
}
703+
body.signup-form .nav-item.show .nav-link,
704+
body.signup-form .nav-link.active {
705+
border-top-width: 1px;
706+
border-top-color: initial;
707+
border-bottom-color: var(--bs-djc-blue-bg);
708+
}
696709
body.signup-form label {
697710
display: none;
698711
}

‎dje/registration.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -165,14 +165,14 @@ def helper(self):
165165
),
166166
Div(
167167
Field("updates_email_notification"),
168-
css_class="alert alert-primary px-2",
168+
css_class="alert alert-primary px-2 py-2",
169169
),
170170
"hcaptcha",
171171
tos,
172172
Div(
173173
StrictSubmit(
174174
"submit",
175-
_("Create your account"),
175+
_("Create account"),
176176
css_class="btn btn-warning",
177177
),
178178
css_class="d-grid",

‎dje/templates/django_registration/registration_form.html‎

Lines changed: 71 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -9,38 +9,72 @@
99

1010
{% block content %}
1111
<div class="row">
12-
<div class="col-sm-6 text-white">
13-
<h2 class="mb-3">Explore DejaCode now</h2>
14-
<p>
15-
A free DejaCode trial account allows you to use DejaCode in a shared public dataspace!
16-
</p>
17-
<p>When you sign in to the DejaCode public evaluation dataspace with your free trial account, you can:</p>
18-
<ul>
19-
<li>Explore, create, and modify components, packages, licenses and assign usage policies to them.</li>
20-
<li>Create your own test products and generate attribution.</li>
21-
<li>Exercise the DejaCode API and DejaCode integrations with open source tools, such as ScanCode.io.</li>
22-
<li>Run reports and use workflow requests.</li>
23-
</ul>
24-
<p>To get started, sign up for a free DejaCode trial account via the form on this page.</p>
25-
26-
<h2 class="mt-4 mb-3">Securely use your own data</h2>
27-
<p>
28-
We can set up a private instance for evaluating DejaCode using your own data,
29-
with access to all features including:
30-
</p>
31-
<ul>
32-
<li>Import your own data privately and securely, including proprietary and third-party software components and licenses.</li>
33-
<li>Design and apply your own usage policies.</li>
34-
<li>Create your own workflow requests and reports.</li>
35-
<li>Generate FOSS compliance artifacts, including Software Bill of Materials (SBOM) for your products and attribution notices.</li>
12+
<div class="col-sm-5 text-white" style="font-size: 1.1rem !important;">
13+
<ul class="nav nav-tabs nav-fill" role="tablist">
14+
<li class="nav-item" role="presentation">
15+
<a class="nav-link active" role="tab" aria-controls="explore-now-tab" aria-current="page" data-bs-toggle="tab" data-bs-target="#explore-now-tab" href="#">Explore now</a>
16+
</li>
17+
<li class="nav-item" role="presentation">
18+
<a class="nav-link" role="tab" aria-controls="about-tab" data-bs-toggle="tab" data-bs-target="#about-tab" href="#">About DejaCode</a>
19+
</li>
20+
<li class="nav-item" role="presentation">
21+
<a class="nav-link" role="tab" aria-controls="private-evaluation-tab" data-bs-toggle="tab" data-bs-target="#private-evaluation-tab" href="#">Private Evaluation</a>
22+
</li>
3623
</ul>
37-
<p>Each private evaluation is limited to 30 days with unlimited use of DejaCode and free support.</p>
38-
<a class="btn btn-warning" href="https://nexb.com/evaluation/" target="_blank">
39-
Request private evaluation
40-
</a>
24+
<div class="tab-content p-3">
25+
<div class="tab-pane fade show active" id="explore-now-tab" role="tabpanel" aria-labelledby="explore-now-tab">
26+
<h4 class="text-warning mb-3 mt-2">Get Started with DejaCode for Free</h4>
27+
<p>
28+
Sign up for a <strong>free DejaCode account</strong> and access a shared public dataspace where you can:
29+
</p>
30+
<ul class="list-unstyled ms-3">
31+
<li class="mb-3">✅ <strong class="text-warning">Explore Packages, Components, and Licenses</strong></li>
32+
<li class="mb-3">✅ <strong class="text-warning">Create & Track Products</strong> – Manage your software inventory effortlessly and Generate attribution.</li>
33+
<li class="mb-3">✅ <strong class="text-warning">Assign Usage Policies</strong> – Define and apply license policies on your inventory items.</li>
34+
<li class="mb-3">✅ <strong class="text-warning">Leverage Powerful Integrations</strong> – Leverage tools like <a class="text-warning text-decoration-underline" href="https://github.com/aboutcode-org/scancode.io" target="_blank">ScanCode.io</a> for seamless code scanning, and <a class="text-warning text-decoration-underline" href="https://github.com/aboutcode-org/vulnerablecode" target="_blank">VulnerableCode</a> for vulnerability management.</li>
35+
<li class="mb-3">✅ <strong class="text-warning">Run Reports & Automate Workflows</strong> – Gain insights with built-in reporting and workflow automation.</li>
36+
</ul>
37+
<p>
38+
<strong>Ready to get started?</strong> Sign up now for a <strong>free DejaCode trial</strong> using the form on this page!
39+
</p>
40+
</div>
41+
<div class="tab-pane fade" id="about-tab" role="tabpanel" aria-labelledby="about-tab">
42+
<h4 class="text-warning mb-3 mt-2">Automate Enterprise-Wide Continuous Compliance with DejaCode</h4>
43+
<p>
44+
<strong>Your system of record for SBOMs, backed by open data.</strong>
45+
</p>
46+
<ul class="list-unstyled ms-3">
47+
<li class="mb-3">✅ <strong class="text-warning">Scan & Track Open Source and Third-Party Components</strong> – Identify and manage all open source and third-party software used in your projects.</li>
48+
<li class="mb-3">✅ <strong class="text-warning">Enforce Compliance Policies</strong> – Apply usage policies at the license or package level and integrate with ScanCode to ensure compliance.</li>
49+
<li class="mb-3">✅ <strong class="text-warning">Capture & Maintain SBOMs</strong> – Generate, store, and manage Software Bill of Materials (SBOMs) while keeping historical data for audits.</li>
50+
<li class="mb-3">✅ <strong class="text-warning">Enterprise-Grade Compliance & DevOps Integration</strong> – Leverage advanced compliance features with seamless integration into DevOps and software workflows.</li>
51+
</ul>
52+
</div>
53+
<div class="tab-pane fade" id="private-evaluation-tab" role="tabpanel" aria-labelledby="private-evaluation-tab">
54+
<h4 class="text-warning mb-3 mt-2">Private DejaCode Evaluation Instance</h4>
55+
<p>
56+
We can set up a private instance for evaluating DejaCode using your own data, with access to all features, including:
57+
</p>
58+
<ul class="list-unstyled ms-3">
59+
<li class="mb-3">✅ <strong class="text-warning">Import your own data privately and securely</strong>, including proprietary and third-party software components and licenses.</li>
60+
<li class="mb-3">✅ <strong class="text-warning">Design and apply your own usage policies</strong>.</li>
61+
<li class="mb-3">✅ <strong class="text-warning">Create your own workflow requests and reports</strong>.</li>
62+
<li class="mb-3">✅ <strong class="text-warning">Generate FOSS compliance artifacts</strong>, including Software Bill of Materials (SBOM) for your products and attribution notices.</li>
63+
</ul>
64+
<p>
65+
<strong>Each private evaluation is limited to 30 days</strong> with unlimited use of DejaCode and free support.
66+
</p>
67+
<div class="d-grid">
68+
<a class="btn btn-warning" href="https://nexb.com/evaluation/" target="_blank">
69+
Request private evaluation
70+
</a>
71+
</div>
72+
</div>
73+
</div>
4174
</div>
4275

4376
<div class="col-sm-5 offset-sm-1">
77+
<h1 class="text-white mt-0 mb-2">Create your DejaCode account</h1>
4478
<div class="card">
4579
<div class="card-body">
4680
{% crispy form %}
@@ -53,4 +87,12 @@ <h2 class="mt-4 mb-3">Securely use your own data</h2>
5387
</div>
5488
{% endblock %}
5589

56-
{% block footer %}{% endblock %}
90+
{% block footer %}
91+
<footer class="mt-auto">
92+
<div class="container">
93+
<p class="text-center text-white mb-2">
94+
Copyright (c) nexB Inc., AboutCode and others.
95+
</p>
96+
</div>
97+
</footer>
98+
{% endblock %}

‎docker-compose.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,31 @@ services:
2323
- redis_data:/data
2424
restart: always
2525

26+
# This service is responsible for ensuring the correct ownership of files
27+
# in the shared volumes used by the application (static and media).
28+
# It ensures that all files inside the `/var/dejacode/` directory are owned
29+
# by the user and group with the UID and GID defined in the environment variables
30+
# APP_UID and APP_GID, which default to 1000 if not set.
31+
#
32+
# The service runs only once (due to "restart: no") and performs a `chown` operation
33+
# to change the ownership of the static and media directories, ensuring proper
34+
# file access rights for the running application containers.
35+
#
36+
# Volumes mounted:
37+
# - static: Ensures the ownership of static files in the /var/dejacode/static directory
38+
# - media: Ensures the ownership of media files in the /var/dejacode/media directory
39+
#
40+
# Notes: This service can be removed once DejaCode 5.3.0 will be released.
41+
chown:
42+
image: alpine:latest
43+
restart: "no"
44+
command: chown -R ${APP_UID:-1000}:${APP_GID:-1000} /var/dejacode/
45+
env_file:
46+
- docker.env
47+
volumes:
48+
- static:/var/dejacode/static
49+
- media:/var/dejacode/media
50+
2651
web:
2752
build: .
2853
command: sh -c "
@@ -46,6 +71,8 @@ services:
4671
condition: service_started
4772
clamav:
4873
condition: service_started
74+
chown:
75+
condition: service_completed_successfully
4976

5077
worker:
5178
build: .
@@ -63,6 +90,7 @@ services:
6390
- redis
6491
- db
6592
- web
93+
- chown
6694

6795
scheduler:
6896
build: .
@@ -78,6 +106,7 @@ services:
78106
- redis
79107
- db
80108
- web
109+
- chown
81110

82111
nginx:
83112
image: nginx:alpine

‎docs/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ Welcome to the very start of your DejaCode journey!
4141
reference-vulnerability-management
4242
reference-1
4343
reference-2
44+
reference-3-cravex
4445

4546
.. toctree::
4647
:maxdepth: 1

‎docs/reference-3-cravex.rst‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
.. _reference_3_cravex:
2+
3+
========================================
4+
Reference 3 - CRAVEX support in DejaCode
5+
========================================
6+
7+
This essay describes DejaCode features that support CRA compliance activities.
8+
9+
The EU's Cyber Resilience Act (CRA) aims to enhance the cybersecurity of products
10+
with digital elements, ensuring that hardware and software sold in the EU are
11+
designed with strong security measures, and manufacturers remain responsible for
12+
cybersecurity throughout the product lifecycle.
13+
14+
A VEX (Vulnerability Exploitability eXchange) document is a standardized format, part
15+
of the Cybersecurity and Infrastructure Security Agency (CISA) initiative, that provides
16+
a machine-readable way to share information about the exploitability of vulnerabilities
17+
in software products, helping organizations prioritize cybersecurity efforts.
18+
19+
Key Objectives of the CRA
20+
-------------------------
21+
22+
* **Enhanced Cybersecurity**: The CRA aims to improve the cybersecurity of products
23+
with digital elements, including both hardware and software.
24+
* **Manufacturer Responsibility**: The CRA places responsibility on manufacturers to
25+
ensure the cybersecurity of their products throughout the entire lifecycle, from design
26+
to end-of-life.
27+
* **EU-Wide Standardization**: The CRA aims to establish common cybersecurity rules and
28+
standards across the EU, facilitating compliance for manufacturers and developers.
29+
* **Consumer Protection**: The CRA aims to protect consumers and businesses from the
30+
risks posed by inadequate cybersecurity measures in digital products.
31+
* **Transparency**: The CRA aims to improve transparency about the cybersecurity
32+
properties of products, enabling users to make informed choices.
33+
34+
Key Provisions of the CRA
35+
-------------------------
36+
37+
* **Cybersecurity Requirements**: Manufacturers must ensure that products with digital
38+
elements meet essential cybersecurity requirements, including risk assessments,
39+
security-by-design practices, and vulnerability management.
40+
* **Vulnerability Reporting**: Manufacturers are required to report any actively
41+
exploited vulnerabilities to the European Union Agency for Cybersecurity (ENISA)
42+
within 24 hours.
43+
* **Security Updates**: Manufacturers must provide timely and effective security updates
44+
to address vulnerabilities.
45+
* **Documentation and Certification**: Manufacturers must provide adequate documentation
46+
and certification to demonstrate compliance with the CRA's requirements.
47+
* **Enforcement**: The CRA includes provisions for enforcement, including penalties
48+
for non-compliance.
49+
50+
Key Cybersecurity Features of DejaCode
51+
--------------------------------------
52+
53+
* **Create SBOMs for your products**: Use DejaCode to generate SBOMs (Software Bills of
54+
Materials) in CycloneDX or SPDX format directly from your Product definitions. This
55+
ensures that you identify exactly what is in your product in a machine-readable format
56+
since DejaCode uses the Package URL (PURL) industry standard to identify each software
57+
item (and its origin) in your product.
58+
* **Import SBOMs into your products**: Use DejaCode to import SBOMs in CycloneDX or
59+
SPDX format that you receive from your suppliers or from code that you have scanned
60+
using tools such as ScanCode.io. DejaCode interprets the SBOM details to create packages,
61+
enrich the package metadata, and assign them to your product.
62+
* **Get timely automatic updates from VulnerableCode**: Using the PURL as a reliable and
63+
accurate identifier, DejaCode routinely updates your data to identify known
64+
vulnerabilities, including a calculated Risk factor, and notifies you of new updates.
65+
* **Respond to vulnerabilities in your products**: Leverage the Vulnerability Risk factor
66+
to prioritize your cybersecurity reviews of the software in your products, as supported
67+
by the extensive details that DejaCode has gathered. Enter your status and comments
68+
regarding the reachability and exploitability of specific software vulnerabilities in
69+
the context of your product usage, as well as any actions that you are taking to address
70+
them. Generate VEX documents in a variety of industry-standard formats to communicate
71+
those conclusions to your organization, to your customers, and to ENISA.
72+
* **Track your vulnerability remediations in your products**: As you upgrade or patch
73+
the software in your products, track those updates in DejaCode to support accurate,
74+
up-to-date SBOM revisions that you can provide to interested parties.
75+
76+
Additional Resources
77+
--------------------
78+
79+
Official texts and commentary for the Cyber Resilience Act:
80+
81+
* Text: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847
82+
83+
* Commentary: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
84+
85+
Community discussions:
86+
87+
* https://github.com/orcwg/cra-hub/blob/main/faq.md
88+
89+
* https://orcwg.org/

0 commit comments

Comments
 (0)