GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → ozontech → dtrack-audit

ozontech / dtrack-audit

Licence: GPL-3.0 license
OWASP Dependency Track API client for intergration into CI/CD pipeline

Programming Languages

go
31211 projects - #10 most used programming language
Makefile
30231 projects

Labels

securitycomponent-analysissecurity-toolssoftware-composition-analysis

Projects that are alternatives of or similar to dtrack-audit

dependency-track-maven-plugin
Maven plugin that integrates with a Dependency Track server to submit dependency manifests and optionally fail execution when vulnerable dependencies are found.
Stars: ✭ 28 (-6.67%)
Mutual labels:  component-analysis, software-composition-analysis
dependency-check-plugin
Jenkins plugin for OWASP Dependency-Check. Inspects project components for known vulnerabilities (e.g. CVEs).
Stars: ✭ 107 (+256.67%)
Mutual labels:  component-analysis
scancode.io
ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!
Stars: ✭ 66 (+120%)
Mutual labels:  software-composition-analysis
lunasec
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
Stars: ✭ 1,261 (+4103.33%)
Mutual labels:  software-composition-analysis
vulndb-data-mirror
A simple Java command-line utility to mirror the entire contents of VulnDB.
Stars: ✭ 36 (+20%)
Mutual labels:  software-composition-analysis
Dependencycheck
OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
Stars: ✭ 3,571 (+11803.33%)
Mutual labels:  software-composition-analysis
Retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities
Stars: ✭ 2,909 (+9596.67%)
Mutual labels:  software-composition-analysis
dependency-check-py
🔐 Shim to easily install OWASP dependency-check-cli into Python projects
Stars: ✭ 44 (+46.67%)
Mutual labels:  software-composition-analysis
OpossumUI
A light-weight app to audit and inventory large codebases for open source license compliance.
Stars: ✭ 32 (+6.67%)
Mutual labels:  software-composition-analysis

dtrack-audit

OWASP Dependency Track API client for your security CI/CD pipeline. See Dependency-Track docs: Continuous Integration & Delivery for use case.

Install

Local Installation

Go 1.16+

go install github.com/ozontech/dtrack-audit/cmd/dtrack-audit@latest

Go version < 1.16

go get github.com/ozontech/dtrack-audit/cmd/dtrack-audit

Features

  • Fully configurable via environment variables
  • Async and sync modes. In async mode dtrack-audit simply sends SBOM file to DTrack API (like cURL but in much more comfortable way). Sync mode means: upload SBOM file, wait for the scan result, show it and exit with non-zero code. So you can break corresponding CI/CD job to make developers pay attention to findings
  • You can filter the results. With Sync mode enabled show result and fail an audit if the results include a vulnerability with a severity of specified level or higher. Severity levels are: critical, high, medium, low, info, unassigned
  • Auto creation of projects. With this feautre you can configure SCA (with dtrack-audit) step globally for your CI/CD and it will create project, e.g. with name from environment variable like $CI_PROJECT_NAME. So you don't need to configure it manually for each project
  • Support for TeamCity CI output. You can use -T flag to enable JSON output. After that, activate the Golang build feature.

Sample output

$ cyclonedx-bom -o bom.xml
$ dtrack-audit -s -g high

SBOM file is successfully uploaded to DTrack API. Result token is 12345f5e-4ccb-45fe-b8fd-1234a8bf0081

2 vulnerabilities found!

 > HIGH: Arbitrary File Write
   Component: adm-zip 0.4.7
   More info: https://dtrack/vulnerability/?source=NPM&vulnId=994

 > CRITICAL: Prototype Pollution
   Component: handlebars 4.0.11
   More info: https://dtrack/vulnerability/?source=NPM&vulnId=755
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].