Skip to content

Commit abc3d93

Browse files
rbraynerrbrayner
committed
Generate SBOM
1 parent 00151aa commit abc3d93

File tree

7 files changed

+163
-4
lines changed

7 files changed

+163
-4
lines changed

‎.github/workflows/security_analysis.yml‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88
branches:
99
- main
1010

11-
jobs:
11+
jobs:
1212
grype:
1313
name: Grype
1414
runs-on: ubuntu-latest
@@ -40,7 +40,23 @@ jobs:
4040
with:
4141
image: "localbuild/todo-app:v1"
4242
output-format: table
43-
43+
44+
generate-sbom:
45+
name: Generate SBOM
46+
runs-on: ubuntu-latest
47+
steps:
48+
- name: Checkout source code
49+
uses: actions/checkout@v4
50+
- name: Download CycloneDX CLI
51+
run: |
52+
npm install --global @cyclonedx/cyclonedx-npm
53+
npx @cyclonedx/cyclonedx-npm --output-file bom.json
54+
- name: Upload SBOM artifact
55+
uses: actions/upload-artifact@v3
56+
with:
57+
name: sbom
58+
path: bom.json
59+
4460
bearer:
4561
name: Bearer
4662
runs-on: ubuntu-latest

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
*.env
2+
!template.env
3+
payload.json
4+
bom.json

‎Makefile‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
COMPOSE_FILE = docker-compose.yml
2+
BUILD_NUMBER = v1.0.1
3+
PAYLOAD_FILE = $(PWD)/payload.json
4+
BASE64_FILE= $(PWD)/base64.txt
5+
6+
.DEFAULT_GOAL := help
7+
8+
# Load the .env file
9+
ifneq (,$(wildcard .env))
10+
include .env
11+
export $(shell sed 's/=.*//' .env)
12+
endif
13+
14+
export
15+
16+
all: run open cyclonedx-install cyclonedx-upload-sbom ## Run all
17+
18+
help:
19+
@echo "Available targets:"
20+
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' Makefile | awk 'BEGIN {FS = ":.*?## "}; {printf " \033[36m%-15s\033[0m %s\n", $$1, $$2}'
21+
22+
run: ## Run the app
23+
docker compose -f $(COMPOSE_FILE) up --build -d
24+
25+
open: ## Open URLs
26+
open http://localhost:3000
27+
open http://localhost:8080/login
28+
29+
cyclonedx-install: ## Install CycloneDX
30+
npm install --global @cyclonedx/cyclonedx-npm
31+
32+
cyclonedx-upload-sbom: ## Uploads the SBOM to Dependency Track via API
33+
@/bin/sh scripts/upload-sbom-to-dependency-track.sh
34+
35+
clean: ## Wipe all data
36+
@docker compose down
37+
@docker volume rm dtrack

‎README.md‎

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,58 @@
11
# Getting started
22

3+
- [Getting started](#getting-started)
4+
- [1. GitHub](#1-github)
5+
- [2. SBOM](#2-sbom)
6+
- [2.1 Deploy](#21-deploy)
7+
- [2.2 Edit .env](#22-edit-env)
8+
- [2.3 Upload SBOM](#23-upload-sbom)
9+
- [2.4 Cleanup](#24-cleanup)
10+
11+
12+
13+
## 1. GitHub
14+
315
This repository is a sample application for users following the getting started guide at https://docs.docker.com/get-started/.
416

5-
The application is based on the application from the getting started tutorial at https://github.com/docker/getting-started
17+
The application is based on the application from the getting started tutorial at https://github.com/docker/getting-started
18+
19+
20+
21+
## 2. SBOM
22+
23+
### 2.1 Deploy
24+
25+
```shell
26+
make run
27+
```
28+
Then, you should be able to access the application and dependency track:
29+
30+
```shell
31+
http://localhost:3000/
32+
http://localhost:8080/login
33+
```
34+
35+
### 2.2 Edit .env
36+
37+
Use the `template.env` file to create a `.env` file with secrets. These secretes should be created by logging into dependency track, creating a project and obtaining an API token and the project ID. The default username and password are `admin/admin`.
38+
39+
```shell
40+
http://localhost:8080/login
41+
```
42+
43+
### 2.3 Upload SBOM
44+
45+
Run the following command and go to the project in dependency track. You should now view SBOM report.
46+
47+
```shell
48+
make all
49+
```
50+
51+
### 2.4 Cleanup
52+
53+
```shell
54+
make clean
55+
```
56+
57+
58+

‎docker-compose.yml‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
services:
22
todoapp:
33
image: todoapp:${BUILD_NUMBER}
4+
build:
5+
context: .
6+
dockerfile: Dockerfile
47
ports:
5-
- 3000:3000
8+
- '127.0.0.1:3000:3000'
69
deploy:
710
restart_policy:
811
condition: on-failure
@@ -14,5 +17,25 @@ services:
1417
source: todo-db
1518
target: /etc/todos
1619

20+
dtrack-apiserver:
21+
image: dependencytrack/apiserver:4.12.0
22+
ports:
23+
- '127.0.0.1:8081:8080'
24+
volumes:
25+
- 'dependency-track:/data'
26+
restart: unless-stopped
27+
28+
dtrack-frontend:
29+
image: dependencytrack/frontend:4.12.0
30+
depends_on:
31+
- dtrack-apiserver
32+
environment:
33+
- API_BASE_URL=http://localhost:8081
34+
ports:
35+
- '127.0.0.1:8080:8080'
36+
restart: unless-stopped
37+
1738
volumes:
1839
todo-db:
40+
dependency-track:
41+
name: dtrack

‎scripts/upload-sbom-to-dependency-track.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/sh
2+
3+
SBOM_FILE="bom.json"
4+
BASE64_FILE=$(mktemp)
5+
6+
npx @cyclonedx/cyclonedx-npm --output-file ${SBOM_FILE}
7+
cat ${SBOM_FILE} |base64 > ${BASE64_FILE}
8+
9+
cat <<EOF > ${PAYLOAD_FILE}
10+
{
11+
"project": "${PROJECT_ID}",
12+
"bom": "$(cat ${BASE64_FILE})"
13+
}
14+
EOF
15+
16+
rm -f ${BASE64_FILE}
17+
18+
curl -X PUT \
19+
-H "Content-Type: application/json" \
20+
-H "X-API-Key: ${API_TOKEN}" \
21+
-d @${PAYLOAD_FILE} \
22+
"http://localhost:8081/api/v1/bom"
23+

‎template.env‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
2+
API_TOKEN=xxx
3+
PROJECT_ID=xxx

0 commit comments

Comments
 (0)