demo.obmka.xyz

SBOM Demo Console

Every service of the CI/CD and SBOM demo. The dot shows whether the service answers right now. Logins: run make creds in the sbom-demo repo.

Source and CI

GitLab Repos, pipelines, common-ci templates gitlab.demo.obmka.xyz · user root

Artifacts

Nexus Registries and the sbom-evidence archive nexus.demo.obmka.xyz · user admin Docker snapshot Every main build, tag = build version docker.demo.obmka.xyz · user ci Docker prod Released images, redeploy disabled docker-prod.demo.obmka.xyz · user ci

Security

Dependency-Track SBOM portfolio, findings, policies, VEX dtrack.demo.obmka.xyz · user admin

Delivery and alerts

ArgoCD GitOps sync of dev, int, uat, prod argocd.demo.obmka.xyz · user admin Mailpit Dependency-Track and GitLab notification mails mail.demo.obmka.xyz · user demo

Sample apps

AppTypedevintuatprod
claims/claim-servicemaven open open open open
portal/customer-portalnpm open open open open
sales/pricing-servicepython open open open open

Demo script

  1. Open an MR in claims/claim-service: tests, SAST, secret scan and the warn-only dependency scan run.
  2. Merge it. The main pipeline builds the image, uploads both SBOMs to Dependency-Track, signs the image and archives the evidence in Nexus.
  3. dev and int deploy on their own through ArgoCD.
  4. Run promote:uat, merge the MR in claim-service-devops, sync uat in ArgoCD.
  5. Run promote:prod: the gate fails on log4j-core CVE-2021-44228 (critical).
  6. Either bump log4j-core in a new MR, or record an analysis for the finding in Dependency-Track. Re-run promote:prod: it passes, copies the image to docker-prod and opens the prod MR.
  7. Merge the prod MR. ArgoCD deploys prod and tags the version deployed:prod in Dependency-Track.
  8. The alert mails are in Mailpit.