Skip to content

Commit 8c447b7

Browse files
TracyRaganTracyRagan
authored
Merge pull request #102 from ortelius/dev
Added OSV.dev integrations
2 parents 3d5ec77 + 6014ab1 commit 8c447b7

7 files changed

+84
-12
lines changed

‎content/en/guides/userguide/integrations/CI-CD_Integrations.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: "Using Ortelius with CI/CD"
3-
linkTitle: "Using Ortelius with CI/CD"
4-
weight: 49
2+
title: "CI/CD Support"
3+
linkTitle: "CI/CD Support "
4+
weight: 300
55
description: >
66
Integrating Ortelius into your CI/CD process.
77
---

‎content/en/guides/userguide/integrations/CircleCI.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: "CircleCI Deployment Orb"
33
linkTitle: "CircleCI Deployment Orb"
4-
weight: 58
4+
weight: 301
55
description: >
66
Using the CircleCI Orb with Ortelius.
77
---
@@ -20,7 +20,7 @@ The Ortelius CircleCI Orb calls Ortelius to perform:
2020
| **microservice_version_update_job** | Automatically increments the version number of a microservice and the application prior to deployment.  Tracks dependency relationships between microservices and applications to create dependency maps.|
2121
| **deploy_job**| Deploys an application version to a specified environment. CircleCI will pass the application version name and environment to Ortelius.|
2222
| **envscript_job**| Generates a script that captures additional information from CircleCI, Git and Environment TOML file. This script is used in subsequent steps for adding additional information to Ortelius. |
23-
| **approve_job** | Supported for DeployHub Pro users. Allows CircleCI to call Ortelius' approval process to approve an application version to be moved to the next stage of the pipeline.  The approval occurs as the UserID is passed from CircleCI to Ortelius. Depending on your Ortelius configuration, you may need to call the ApproveJob. This would happen if an approval gate is defined in Ortelius.  CircleCI will pass the application version and the 'Move' task to Ortelius.|
23+
2424

2525
You do not need to use the 'approve_job 'or 'move_job' functions. The use of these jobs is determined by how you define your CircleCI pipeline.  If you are using Approvals in CircleC, the approve_job records the approval information as part of the microservice deployment meta.  A 'Move' process tracks where the microservice and application versions are in the pipeline.  You would generally perform a 'Move' and then a 'Deploy.'  Using the microservice_version_update_job is recommended before the deploy_job.  This allows Ortelius to perform your versioning, configuration management, dependency mapping and comparisons.  The deploy_job calls on Ortelius' back in release engine to move the objects to endpoints (clusters for example.)
2626

‎content/en/guides/userguide/integrations/Intro to Deployment Integrations.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: "Ortelius Deployment Integrations"
3-
linkTitle: "Ortelius Deployment Integrations"
4-
weight: 49
2+
title: "Deployment Integrations"
3+
linkTitle: "Deployment Integrations"
4+
weight: 305
55
description: >
66
Integrating Ortelius with your Deployment Solution.
77
---

‎content/en/guides/userguide/integrations/OSVDev.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "OSV.Dev CVE Integration"
3+
linkTitle: "OSV.Dev CVE Integration"
4+
weight: 315
5+
description: >
6+
Cross Referencing Packages with CVE Database
7+
---
8+
9+
## OSV
10+
11+
Ortelius uses [OSV.dev](https://osv.dev/) to cross reference packages for gathering CVE data. Every 30 minutes Ortelius performs an OSV.dev look up for every package listed in every SBOM to determine if any vulnerabilities exist. The look-up is performed using the OSV public facing APIs. SBOM generation is required to perform this scan.
12+
13+
The CVE results are displayed at two levels, the _Component Version_ and the _Application Version_. If you have included SBOM scanning as part of your DevOps pipeline, you will pass the name of the SBOM to Ortelius using the [Ortelius CLI](/guides/userguide/integrations/ci-cd_integrations/). Ortelius supports SPDX and CycloneDX SBOM formats. If you have not added SBOM's as part of your DevOps Pipeline, you can include it through the Ortelius CLI process. The Ortelius CLI uses [Syft](/guides/userguide/integrations/spdx-cyclonedx-syft/) to generate the SBOM.
14+
15+
> Note: Ortelius must have access to OSV.Dev in order to continuously gather the CVE data.
16+
17+
### Viewing Component CVE Data
18+
19+
CVE data is associated to a particular _Component Version_ and can be seen by going to the Component Detail View. Ortelius gathers the CVE information every 30 minutes for all Components. For this reason it is possible for new CVEs to appear. If a new CVE is found by OSV.dev, Ortelius automatically updates your Component's CVEs.
20+
21+
### Viewing Application Level CVE Data
22+
23+
Ortelius aggregates lower-level _Component_ data up to all consuming applications. When you view the CVEs at the _Application Version_ level, you are seeing a combination of all CVEs aggregated from the _Components_ which your _Application_ depends. Your _Applications_ CVE data can change over time based on the changes at the _Component Version_ level.

‎content/en/guides/userguide/integrations/OpenMake Meister.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: "OpenMake Meister Binary Repository"
33
linkTitle: "OpenMake Meister"
4-
weight: 71
4+
weight: 320
55
description: >
66
Referencing binaries from the OpenMake Meister Build System.
77
---

‎content/en/guides/userguide/integrations/SBOM Support.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: "Passing Your SBOMs to Ortelius"
3-
linkTitle: "Passing Your SBOMs to Ortelius"
4-
weight: 71
2+
title: "SBOMs and Ortelius"
3+
linkTitle: "SBOMs and Ortelius"
4+
weight: 307
55
description: >
66
Passing Your SBOMs to Ortelius
77
---

‎content/en/guides/userguide/integrations/SPDX-CycloneDX-Syft.md

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
title: "SPDX, CycloneDX and Syft"
3+
linkTitle: "SPDX, CycloneDX and Syft"
4+
weight: 310
5+
description: >
6+
Collecting SBOM data with SPDX, CycloneDX and Syft.
7+
---
8+
9+
Ortelius can consume any SPDX and CycloneDX formatted SBOM. If you are already generating SBOMs, you will pass the name of the SBOM results to Ortelius as shown below. If you are not generating SBOMs as part of your pipeline process, you will need to add SBOM generation to collect the lower dependency data. Following is how to add Syft to your workflow to include the collection of SBOM data.
10+
11+
## Adding Syft to your Pipeline Automation
12+
13+
[Syft SBOM tool](https://github.com/anchore/syft) will generate Software Bill of Material Reports for popular coding languages and package managers, including Docker images.
14+
15+
The following code example scans a Docker Image to generate the SBOM. See [Syft Options](https://github.com/anchore/syft#supported-sources) to scan other objects and coding languages.
16+
17+
```bash
18+
# install Syft
19+
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b $PWD
20+
21+
# create the SBOM
22+
./syft packages $DOCKERREPO:$IMAGE_TAG --scope all-layers -o cyclonedx-json > cyclonedx.json
23+
24+
# display the SBOM
25+
cat cyclonedx.json
26+
```
27+
28+
## Passing the Name of the SBOM Results
29+
30+
>Note: To complete the process you will need to install the Ortelius CLI where your CI/CD server is running. Refer to the [Ortelius GitHub CLI Documentation](https://github.com/Ortelius/cli/blob/main/doc/dh.md) for installation instructions.
31+
32+
Execute the following calls to the Ortelius CLI as part of your workflow. It should be called after the build and SBOM generation:
33+
34+
With CycloneDX SBOM
35+
36+
```bash
37+
dh updatecomp --rsp component.toml --deppkg "cyclonedx@name of your SBOM file"
38+
39+
Example:
40+
dh updatecomp --rsp component.toml --deppkg "cyclonedx@cyclonedx.json"
41+
```
42+
With SPDX SBOM
43+
44+
```bash
45+
dh updatecomp --rsp component.toml --deppkg "spdx@name of your SBOM file. "
46+
47+
Example:
48+
dh updatecomp --rsp component.toml --deppkg "spdx@spdx.json"
49+
```

0 commit comments

Comments
 (0)