This repo contains articles, videos, and resources on software supply chain security that I came across during my research. Below, you can first see the architecture of the project to be implemented and access the detailed technology stack through the links.

🔗 GitHub Links

🎥 Videos

📝 Article

👤 LinkedIn Profiles to Follow

Installed with docker-compose.yaml

• docker pull sonarqube:communition
• docker run -d --name sonarqube -p 9000:9000 -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -e SONAR_JAVA_OPTS="-Xmx4g -Xms512m -XX:+HeapDumpOnOutOfMemoryError" sonarqube:community

We can use below command for project SCA

• You must install sonar-scanner your local desktop

• How to create a token => My Account=> Security=> Generate Tokens

• mvn clean package sonar:sonar -Dsonar.projecKey=secure-devOps -Dsonar.host.url=http://localhost:9000 -Dsonar.login=sqa_8d5781d430cef6f2ba2c08e691ef6b01bd0c8f28 -Dsonar.exclusions=**/*.java this login token will be changing because of this sonarqube does not persistent

We will creating a image with buildpacks Buildpacks

• How to use jib with our java project
• mvn clean install -P create-image-openjdk => max size
• mvn clean install -P create-image-openjdk-slim
• mvn clean install -P create-image-openjdk-jre => min size
• 

• How to install trivy
• trivy image dogandemir51/secure:0.0.1
• trivy image --format json --output trivy-scanning.json dogandemir51/secure:0.0.1

• helm
• helm create securechart
• You must change values.yaml for your application
• helm install secure ./securechart

• Kyverno
• Installation
• ExamplePolicy

• Installation
• cosign generate-key-pair
• cosign sign --key cosign.key dogandemir51/secure:0.0.1
• cosign verify --key cosign.pub dogandemir51/secure:0.0.1