How-to

Updated 2024-12-05 SBOM Central

This chapter outlines common activities and workflows in the WebApp.

Artifacts and components

Updated 2024-12-04 SBOM Central

The permission "Create/update/destroy license types" is needed to edit license type pages.

  • Open page: Main menu/License types.
  • Push the Create button in top of the page to open a pop-up edit window.

  • Edit texts and selections.
Attribute Description
Name The name of the license type
SPDX The SPDX (external link)identifier.
Name patterns License names that automatically will be assigned to this license type. The selection box is editable.
Recommendation Recommendation setting for use of software with this license type: Approve/For internal use only/Deny.
Permissiveness Public domain/Permissive/Weak copyleft/Copyleft/Proprietary.
Use template Activate the template. Opens a text field for adding template text.
Template Template license text.
Updated: 2024-12-04 SBOM Central

External artifacts has a Licenses tab in their show page. Licenses are often retrieved from uploaded SBOMs, or external data sources (websites), but you can also add licenses manually.

Push Create button to open an edit pop-up window.

Edit texts and selections.

Name Description
Type Select License type for the license.
Name Edit a name for the license.
Custom text Activate text area.
Text Edit (or Paste) the license text.
Approved An ability to directly approve the license.
Ignore Ignore the license.


Modify the license

A manually created license may be modified by pushing the Edit button.

Reports

Updated 2024-12-04 SBOM Central

A modern CI/CD workflow generates SBOMs continuously; however, only a select few are crucial for purposes such as releases, deliveries, traceability, and historical records.

In SBOM Central, these significant SBOMs are highlighted by creating a Delivery Report.

Open the SBOM show page

... and select the Deliveries tab.

Push Create report button

... to open the create dialog.

Click Save and a delivery report is created.

Read more at:

Updated 2024-12-04 SBOM Central

TODO TODO

A modern CI/CD workflow generates SBOMs continuously; however, only a select few are crucial for purposes such as releases, deliveries, traceability, and historical records.

In SBOM Central, these significant SBOMs are highlighted by creating a Delivery Report.

Open the SBOM show page

... and select the Deliveries tab.

Push Create report button

... to open the create dialog.

Click Save and a delivery report is created.

Read more at:

Updated 2024-12-05 SBOM Central

A released product should be represented by an SBOM that specifies the product name and version. In SBOM Central, the SBOM is actively monitored for newly discovered vulnerabilities, with notifications automatically triggered upon detection. The "released" SBOM should also include an attached Delivery Report.

Any detected vulnerability must be carefully analyzed, and appropriate actions decided upon. This analysis and decision-making process will be directly tied to the SBOM/Delivery Report and will form the foundation for generating a VEX report.

Open the SBOM show page and select the vulnerabilities tab.

Review and analyze vulnerabilities individually, ensuring each one is thoroughly assessed as required.

When analysis is finished go to the Deliveries tab and push the Generate VEX for the current Delivery report.

Select all vulnerabilities that you want to be included into the VEX report and push Save.

Updated 2024-12-04 SBOM Central

TODO TODO

A modern CI/CD workflow generates SBOMs continuously; however, only a select few are crucial for purposes such as releases, deliveries, traceability, and historical records.

In SBOM Central, these significant SBOMs are highlighted by creating a Delivery Report.

Open the SBOM show page

... and select the Deliveries tab.

Push Create report button

... to open the create dialog.

Click Save and a delivery report is created.

Read more at:

Updated 2024-12-05 SBOM Central

Example: SBOM Central has identified a critical vulnerability in one of your products, and you are required to release an advisory report to your customers. A software update is not necessary, but some configuration changes are required. The following are the steps:

Updated 2024-12-05 SBOM Central

Example: SBOM Central has identified a critical vulnerability in one of your products, and you are required to release an advisory report to your customers. A software update is not necessary, but some configuration changes are required. The following are the steps:

Users and teams

You need the "Create teams" and "Update teams" permissions to do this.

  1. In the Main menu, select Teams.
  2. On the Teams page, click on the Create button to open the pop-up window.
  3. Edit your teams data.
  1. Edit the team name.
  2. Edit the description.
  3. Save
  1. Now the team is ready for configuring:
    1. Members
    2. Team permissions
    3. Tracker projects
    4. Components

You need the "Create/update users" permission to do this.

Create a user:

  1. Open Main menu/Users.
  2. Click "+Create" button to open editable pop-up window.

A user becomes Active when added to a team, and stays Active as long the user belongs to at least one team.

  1. Upload avatar : select a local image file to upload as user avatar (optional)

  2. Name : type a username. It is case sensitive.

    The username is matched to users in code commits.

  3. Email : type email address.

    LDAP settings decides if username or email is used at MAIA login (also at local authentication when LDAP is present).

  4. Inactivity timeout : type the number of seconds before session timeout (optional)

  5. Local environment : i.e. select the local (private) host of the user (optional).

  6. Default component tab : select the tab that will open first when a user navigates to a component page (optional).

  7. Local auth : select if local authentication (optional).

    If local auth and no LDAP present : the default login user is the email address.

  8. If local auth, Password : type the password.

  9. Password confirmation : type the same password as in the previous step.

  10. Click Save.

Results