Skip to content

Dependency-Track

Description

Single Bill of Materials (SBOM): Track usage of libraries and frameworks, applications, containers, operating systems, firmware, hardware, and services across all projects in the Dependency-Track portfolio.

Bring vulnerable components to light with support for multiple sources of vulnerability intelligence including the National Vulnerability Database (NVD), Sonatype OSS Index, GitHub Advisories, Snyk, OSV, and VulnDB from Risk Based Security.

Depdency-track SBOM updating needs these applications

Syft https://github.com/anchore/syft/releases

cyclonedx-cli https://github.com/CycloneDX/cyclonedx-cli/releases/tag/v0.25.1

Curl sudo apt install curl JQ sudo apt install jq

gh https://github.com/cli/cli/blob/trunk/docs/install_linux.md

Creating Single Bill of Material (SBOM) files manually

Note: While Dependency-Track has support for CycloneDX version 1.6, the validation tool cyclonedx-cli has support only up to version 1.5.

  1. Use Syft to create a .xml SBOM-file from a repository/directory:
    1. syft scan dir:./ --source-name tms-fleet --source-version 1.5.63 -o cyclonedx-xml@1.5=tms-fleet-v1.5.63-sbom.xml
  2. Validate the SBOM file:
    1. cyclonedx-cli validate --input-file tms-fleet-v1.5.63-sbom.xml --input-format xml
      1. The output should be "BOM validated successfully."
  3. In Dependency-Track, find or create the project that you are uploading the SBOM file to. Copy the project ID.
  4. In Dependency-Track, find or create the API key of the team (Administration ➝ Access Management ➝ Teams) you want to use to upload the SBOM file with, used in the next step.
  5. Upload it with cURL:
    1. Change the URL, API-key, project etc. to match your needs.
curl -X "POST" "http://dtrack-api.local:8080/api/v1/bom" \
     -H 'Content-Type:multipart/form-data' \
     -H "X-Api-Key: odt_zMjSdQGiZVbqp0ry7CAq3nKsshZl7NZ8" \
     -F "project=83c1d0f1-3776-4600-ab19-2ee9697ed4f9" \
     -F "autoCreate=true" \
     -F "projectName=tms-fleet" \
     -F "projectVersion=1.5.63" \
     -F "bom=@tms-fleet-v1.5.63-sbom.xml"

Manual script automation method

Todo: write how to use scripts Todo: make scripts use an inventory of repositories Todo: Make Dependency-Track token authentication happen via terminal input, rather than being hard-coded§ Todo: Split the script into smaller chunks to make it more readable Scripts are here:

[

github.com

https://github.com/Attracs/docker-devops-dependency-track/tree/main/manual-runs

](https://github.com/Attracs/docker-devops-dependency-track/tree/main/manual-runs)

  1. Install the scripts under /usr/local/bin
    1. Remember to chmod +x
  2. Clone all of the git repos you want to create an SBOM out of under a directory.
    1. Here are two examples to get good candidates:
      1. Curl: 
        curl -H "Authorization: token YOUR_GITHUB_TOKEN" \
     "https://api.github.com/search/repositories?q=org:Attracs+pushed:>$(date -d '90 days ago' +%Y-%m-%d)&per_page=100" | jq -r '.items[].name'
  3. Run run_generate_sbom_with_limit.sh like so:
    1. run_limit_generate_sbom_with_limits.sh <LIMIT-IN-NUMBER-OF-REPOS>

Deployment

Currently no automation has been built, but uploading as a tar package is easy enough: 1. I recommend testing the new docker-container setup in "nightly" first. You will need to: 1. Make the changes you need to make in docker/nightly/ 2. Maybe change the database port 5432 to something else in docker-compose.yml and dtrack.env since that port is already being used by the production Dependency-Track. 3. To do: Figure out if you can bring up another docker container with the same volume names or if an error happens 4. tar -cvf docker_dtrack_nightly.tar.gz docker/nightly 5. gcloud compute scp docker_dtrack_nightly.tar.gz <your-username>@devops-5:~ --project attracs-devops --zone europe-north1-b --tunnel-through-iap 6. tar -xvf docker_dtrack_nightly.tar.gz /etc/docker-dependency-track 7. docker-compose up -d and see how it looks like in the test url https://dependency-track-test-frontend.attracs.com and https://dependency-track-test-api.attracs.com 2. tar -cvf docker_dtrack_stable.tar.gz docker/stable 3. gcloud compute scp docker_dtrack_stable.tar.gz <your-username>@devops-5:~ --project attracs-devops --zone europe-north1-b --tunnel-through-iap 4. SSH to the instance 5. tar -xvf docker_dtrack_stable.tar.gz 6. Switch the new docker-container setup with the old 1. To do: figure out how to keep the database docker volume while changing docker-compose setup

Docker setup

Repository There are three deployment environments to choose from: 1. Stable 2. Nightly 3. Development (local) The setup uses three docker containers: (soon likely database is replaced with Cloud SQL) 1. Dependency-Track API 1. Configured with dtrack.env 2. Dependency-Track Frontend 1. Configured with config.env 3. Database (Postgres) 1. Configured in docker-compose.yml 1. To do, make this better...

Automating Dependency-Track

This is to do (both the implementation and documentation)! Here are some choices: We will probably go with gh-upload-sbom, since it's the official tool from the Dependency-Track team.

[

github.com

https://github.com/DependencyTrack/gh-upload-sbom

](https://github.com/DependencyTrack/gh-upload-sbom)

[

github.com

https://github.com/MediaMarktSaturn/technolinator

](https://github.com/MediaMarktSaturn/technolinator)

[

github.com

https://github.com/marketplace/actions/upload-bom-to-dependency-track

](https://github.com/marketplace/actions/upload-bom-to-dependency-track)

Subpages