Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Fix style for dependency inventory doc #241

Merged
merged 2 commits into from
Sep 16, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 23 additions & 9 deletions docs/docs/guides/dependency-inventory.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,23 @@
---
draft: true
draft: false
title: 📦 Dependency Inventory
---

# Dependency Inventory

In this guide, we will use CycloneDX `gradle` plugin to generate a software
bill of material (SBOM) and scan it using `vet`.

## CycloneDX Plugin Integration

An official [plugin](https://github.com/CycloneDX/cyclonedx-gradle-plugin) can be used with build automation tools such as Gradle, Maven, etc. to generate Software Bill of Materials(SBOM) for a Java/Android/Kotlin projects.
An official [plugin](https://github.com/CycloneDX/cyclonedx-gradle-plugin) can
be used with build automation tools such as Gradle, Maven, etc. to generate
Software Bill of Materials(SBOM) for a Java/Android/Kotlin projects.

### Gradle Plugin Integration

The gradle plugin for generating cyclonedx sbom file has to be integrated into the build script i.e. `build.gradle` file.
The gradle plugin for generating cyclonedx sbom file has to be integrated into
the build script i.e. `build.gradle` file.

```groovy
plugins {
Expand All @@ -34,24 +41,31 @@ cyclonedxBom {
}
```

Based on requirements, `includeConfigs` and `skipConfigs` properties in `cyclonedxBom` can be modified to only include runtime, compile-time, or implementation dependencies in the sbom artifact(s). Additionaly, in a multi-build project, `skipProjects` property can be used to exclude dependency resolution for a sub-project, thus reducing the noise.
Based on requirements, `includeConfigs` and `skipConfigs` properties in
`cyclonedxBom` can be modified to only include runtime, compile-time, or
implementation dependencies in the sbom artifact(s). Additionaly, in
a multi-build project, `skipProjects` property can be used to exclude
dependency resolution for a sub-project, thus reducing the noise.

### SBOM Generation

Now, to generate sbom artifacts, do a clean build of the project using its respective build tool:
`gradle cleanBuild -b build.gradle :cyclonedxBom`
Now, to generate sbom artifacts, do a clean build of the project using its
respective build tool: `gradle cleanBuild -b build.gradle :cyclonedxBom`

![sample gradle build](../../static/img/sample-gradle-build.png)

After a successful build, all the artifacts shall be stored in `build/reports` path, present in the project root.
After a successful build, all the artifacts shall be stored in `build/reports`
path, present in the project root.

## Scan SBOMs using Vet

Vet supports scanning of SBOM files in both SPDX and CycloneDX format. Depending upon the plugin and build tool being used, appropriate parsers can be used to scan the artifacts for a vulnerability report.
vet supports scanning of SBOM files in both SPDX and CycloneDX format.
Depending upon the plugin and build tool being used, appropriate parsers can be
used to scan the artifacts for a vulnerability report.

```
vet scan --lockfiles build/reports/bom.json --lockfile-as bom-cyclonedx --report-markdown=report.md
vet scan --lockfiles build/reports/bom.json --lockfile-as bom-spdx --report-markdown=report.md
```

![vet cyclonedx scan demo](../../static/img/vet-cyclonedx-scan-demo.png)
![vet cyclonedx scan demo](../../static/img/vet-cyclonedx-scan-demo.png)
3 changes: 2 additions & 1 deletion pkg/code/code_graph.go
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,8 @@ func NewCodeGraphBuilder(config CodeGraphBuilderConfig,
config.Concurrency = 1
}

return &codeGraphBuilder{config: config,
return &codeGraphBuilder{
config: config,
repository: repository,
lang: lang,
storage: storage,
Expand Down
Loading