From c28ef9dfd2af10e54f29a5094ec64309a081dd23 Mon Sep 17 00:00:00 2001 From: Lukas Fischer Date: Fri, 20 Oct 2023 15:54:57 +0200 Subject: [PATCH] #2059 Add missing docs to dependencytrack hook When the docs directory is missing, the READMEs for DockerHub and ArtifactHub are not generated. This adds the directory and the missing docs. Signed-off-by: Lukas Fischer --- .../docs/README.ArtifactHub.md | 129 ++++++++++++++++++ .../docs/README.DockerHub-Hook.md | 88 ++++++++++++ 2 files changed, 217 insertions(+) create mode 100644 hooks/persistence-dependencytrack/docs/README.ArtifactHub.md create mode 100644 hooks/persistence-dependencytrack/docs/README.DockerHub-Hook.md diff --git a/hooks/persistence-dependencytrack/docs/README.ArtifactHub.md b/hooks/persistence-dependencytrack/docs/README.ArtifactHub.md new file mode 100644 index 0000000000..31303915c6 --- /dev/null +++ b/hooks/persistence-dependencytrack/docs/README.ArtifactHub.md @@ -0,0 +1,129 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Lab Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on Kubernetes + +You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it. + +## What is "Persistence Dependency-Track" Hook about? +The Dependency-Track persistenceProvider hook saves all generated CycloneDX SBOMs into the configured [OWASP Dependency-Track][dependencytrack.org] instance, other findings or SPDX SBOMs cannot be handled and are ignored. +This allows automatically cataloging infrastructure to gain an overview over the used components and dependencies. +To learn more about Dependency-Track visit [dependencytrack.org]. + +To use the _secureCodeBox_ to generate SBOMs, you can use the [Trivy-SBOM scanner][trivy-sbom]. + +## Deployment +The persistence-dependencytrack chart can be deployed via helm: + +```bash +# Install HelmChart (use -n to configure another namespace) +helm upgrade --install persistence-dependencytrack secureCodeBox/persistence-dependencytrack +``` + +## Requirements + +Kubernetes: `>=v1.11.0-0` + +## Additional Chart Configurations + +Installing the Dependency-Track persistenceProvider hook will add a _ReadOnly Hook_ to your namespace. + +You need to provide the API key to connect to Dependency-Track as a [Kubernetes secret][k8ssecret]. +Check the [Dependency-Track documentation][dt-api-docs], to learn how to configure an API key. + +```bash +kubectl create secret generic dependencytrack-credentials --from-literal="apikey=NoEs..." + +helm upgrade --install dt secureCodeBox/persistence-dependencytrack \ + --set="dependencytrack.url=https://dependency-track-backend.default.svc" +``` + +SBOMs are imported for a project in Dependency-Track. +To avoid configuring all of them by hand first and assigning projects to scans somehow, the hook automatically detects name and version from the scan and then creates Dependency-Track projects if they do not exist yet. +This requires either the `PORTFOLIO_MANAGEMENT` or `PROJECT_CREATION_UPLOAD` permission for the API key which gets used by the hook (or rather for the team the key is defined for). + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| dependencytrack.authentication | object | `{"apiKeyKey":"apikey","userSecret":"dependencytrack-credentials"}` | Authentication information. Dependency-Track expects an API key, which can be generated for a team (see: https://docs.dependencytrack.org/integrations/rest-api/). The hook automatically creates missing projects, for that either the PORTFOLIO_MANAGEMENT or PROJECT_CREATION_UPLOAD permission is required. | +| dependencytrack.authentication.apiKeyKey | string | `"apikey"` | Name of the apikey key in the `userSecret` secret. | +| dependencytrack.authentication.userSecret | string | `"dependencytrack-credentials"` | Link a pre-existing generic secret with `apikey` key / value pair | +| dependencytrack.url | string | `"http://dependency-track-backend.default.svc"` | Url to the Dependency-Track instance, make sure to use the backend url | +| hook.affinity | object | `{}` | Optional affinity settings that control how the hook job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) | +| hook.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | +| hook.image.repository | string | `"docker.io/securecodebox/hook-persistence-dependencytrack"` | Hook image repository | +| hook.image.tag | string | defaults to the charts version | Container image tag | +| hook.labels | object | `{}` | Add Kubernetes Labels to the hook definition | +| hook.priority | int | `0` | Hook priority. Higher priority Hooks are guaranteed to execute before low priority Hooks. | +| hook.resources | object | { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } } | Optional resources lets you control resource limits and requests for the hook container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | +| hook.tolerations | list | `[]` | Optional tolerations settings that control how the hook job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | +| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | +| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | + +## Contributing + +Contributions are welcome and extremely helpful 🙌 +Please have a look at [Contributing](./CONTRIBUTING.md) + +## Community + +You are welcome, please join us on... 👋 + +- [GitHub][scb-github] +- [Slack][scb-slack] +- [Twitter][scb-twitter] + +secureCodeBox is an official [OWASP][scb-owasp] project. + +## License +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +Code of secureCodeBox is licensed under the [Apache License 2.0][scb-license]. + +[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox +[scb-docs]: https://www.securecodebox.io/ +[scb-site]: https://www.securecodebox.io/ +[scb-github]: https://github.com/secureCodeBox/ +[scb-twitter]: https://twitter.com/secureCodeBox +[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU +[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE +[dependencytrack.org]: https://dependencytrack.org/ +[dt-api-docs]: https://docs.dependencytrack.org/integrations/rest-api/ +[k8ssecret]: https://kubernetes.io/docs/concepts/configuration/secret/ +[trivy-sbom]: https://www.securecodebox.io/docs/scanners/trivy-sbom diff --git a/hooks/persistence-dependencytrack/docs/README.DockerHub-Hook.md b/hooks/persistence-dependencytrack/docs/README.DockerHub-Hook.md new file mode 100644 index 0000000000..d266d3bf1d --- /dev/null +++ b/hooks/persistence-dependencytrack/docs/README.DockerHub-Hook.md @@ -0,0 +1,88 @@ + + + +

+ License Apache-2.0 + GitHub release (latest SemVer) + OWASP Lab Project + Artifact HUB + GitHub Repo stars + Twitter Follower +

+ +## What is OWASP secureCodeBox? + +

+ secureCodeBox Logo +

+ +_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios. + +With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues. + +The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure. + +### Quickstart with secureCodeBox on Kubernetes + +You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it. + +## Supported Tags +- `latest` (represents the latest stable release build) +- tagged releases, e.g. `3.0.0`, `2.9.0`, `2.8.0`, `2.7.0` + +## How to use this image +This `hook` image is intended to work in combination with other `parser` images to read or manipulate `findings` results. For more information details please take a look at the [project page][scb-docs] or [documentation page][]. + +```bash +docker pull securecodebox/hook-persistence-dependencytrack +``` + +## What is "Persistence Dependency-Track" Hook about? +The Dependency-Track persistenceProvider hook saves all generated CycloneDX SBOMs into the configured [OWASP Dependency-Track][dependencytrack.org] instance, other findings or SPDX SBOMs cannot be handled and are ignored. +This allows automatically cataloging infrastructure to gain an overview over the used components and dependencies. +To learn more about Dependency-Track visit [dependencytrack.org]. + +To use the _secureCodeBox_ to generate SBOMs, you can use the [Trivy-SBOM scanner][trivy-sbom]. + +## Community + +You are welcome, please join us on... 👋 + +- [GitHub][scb-github] +- [Slack][scb-slack] +- [Twitter][scb-twitter] + +secureCodeBox is an official [OWASP][scb-owasp] project. + +## License +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. + +[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox +[scb-docs]: https://www.securecodebox.io/ +[scb-site]: https://www.securecodebox.io/ +[scb-github]: https://github.com/secureCodeBox/ +[scb-twitter]: https://twitter.com/secureCodeBox +[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU +[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE +[dependencytrack.org]: https://dependencytrack.org/ +[dt-api-docs]: https://docs.dependencytrack.org/integrations/rest-api/ +[k8ssecret]: https://kubernetes.io/docs/concepts/configuration/secret/ +[trivy-sbom]: https://www.securecodebox.io/docs/scanners/trivy-sbom