Wiki source code of Dependency Track
Version 32.2 by Milad Afshar-Jahanshahi on 2025/09/03 12:54
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
30.1 | 1 | STILL UNDER CONSTRUCTION |
| 2 | |||
| |
8.1 | 3 | [[image:logo-dependency-track.YzQAjtqS_Z2pMQkR.webp||alt="Grafana Icon Logo PNG vector in SVG, PDF, AI, CDR format" data-xwiki-image-style-alignment="end" height="52" width="190"]] |
| |
6.1 | 4 | |
| |
29.1 | 5 | {{toc/}} |
| |
28.1 | 6 | |
| |
6.1 | 7 | = Introduction = |
| 8 | |||
| |
31.1 | 9 | Dependency-Track is an open-source Software Composition Analysis (SCA) tool that helps organizations manage and secure their software supply chain. It automatically generates and maintains a Software Bill of Materials (SBOM) for projects, continuously monitoring dependencies for known vulnerabilities. In addition, it tracks license compliance of open-source components, giving teams greater visibility and control. By integrating seamlessly into DevOps and CI/CD pipelines, Dependency-Track makes it easier to embed security throughout the development lifecycle. |
| |
6.1 | 10 | |
| |
9.1 | 11 | [[Vendor Page>>https://dependencytrack.org/]] |
| |
6.1 | 12 | |
| |
9.2 | 13 | There are several useful resources available to get started with Deptrack: |
| |
6.1 | 14 | |
| |
9.2 | 15 | [[Dependency-Track Documentation>>https://docs.dependencytrack.org/]] |
| |
6.1 | 16 | |
| |
14.1 | 17 | [[Impact Analysis>>https://docs.dependencytrack.org/usage/impact-analysis/]] |
| 18 | |||
| |
12.1 | 19 | [[Collection-projects>>https://docs.dependencytrack.org/usage/collection-projects/]] |
| |
6.1 | 20 | |
| |
13.1 | 21 | = Accessing Dependency-Track = |
| |
6.1 | 22 | |
| |
32.2 | 23 | Dependency-Track is integrated into the DOAAS toolchain, but for now it’s only offered in the Pilotkunden Preview. To get started, a few prerequisites need to be in place. |
| |
26.2 | 24 | |
| |
13.1 | 25 | == Preconditions in DevOps portal to access Dependency-Track == |
| |
6.1 | 26 | |
| |
13.1 | 27 | 1. A Dependency-Track license must be assigned to the user |
| 28 | 1. Dependency-Track must be added to the tool list of the project | ||
| |
6.1 | 29 | |
| |
25.1 | 30 | (% class="box warningmessage" %) |
| 31 | ((( | ||
| 32 | ⚠ **Note** | ||
| |
32.2 | 33 | Unlike other tools, login is only possible if the user has a valid license and is assigned a role in at least one Dependency-Track project. |
| |
25.1 | 34 | ))) |
| 35 | |||
| 36 | |||
| 37 | |||
| |
26.1 | 38 | |
| |
26.2 | 39 | |
| |
28.1 | 40 | |
| |
29.1 | 41 | |
| |
30.1 | 42 | |
| |
31.1 | 43 | |
| |
31.2 | 44 | |
| |
32.2 | 45 | |
| |
13.1 | 46 | After completing the preconditions, a project in Dependency-Track, which is part of the DevOps-as-a-Service toolchain, can be accessed via the DevOps Portal or directly through a URL. |
| |
6.1 | 47 | |
| 48 | == Via DevOps Portal == | ||
| 49 | |||
| |
16.1 | 50 | Go to the DevOps Portal Homepage and click on the link //Project// in the Project Vulnerabilities tile: |
| |
6.1 | 51 | |
| |
15.2 | 52 | [[image:deptrack.png||alt="Deptrack -Tile" data-xwiki-image-style-border="true" height="211" width="459"]] |
| |
6.1 | 53 | |
| |
23.2 | 54 | (% class="box warningmessage" %) |
| 55 | ((( | ||
| |
6.1 | 56 | ⚠ **Note** |
| |
16.2 | 57 | If you are still unable to access your project in Dependency-Track, it may be because you are logged in with an old session that still uses outdated permissions or To resolve this issue, please log out and then log in again: |
| |
18.1 | 58 | \\[[image:login1.png||alt="Untitled2.png" height="250" width="600"]] |
| |
23.2 | 59 | ))) |
| |
6.1 | 60 | |
| 61 | == Via Direct URL == | ||
| 62 | |||
| |
13.1 | 63 | You can also access Dependency-Track directly using the following link format: |
| |
23.1 | 64 | [[https:~~/~~/deptrack-<customer~>.devops.t-systems.net/projects>>https://<customer>.devops.t-systems.net/xwiki/wiki/<pkey>/view]] where <customer> is the id of your DevOps-as-a-Service instance. |
| |
6.1 | 65 | |
| 66 | If you are not already logged in to another tool in the toolchain or the DevOps portal, then you have to login using your configured SSO credentials. | ||
| 67 | |||
| 68 | |||
| |
26.1 | 69 | |
| 70 | == Dependency-Track Jenkins Interaction == | ||
| 71 | |||
| 72 | Nur sdcPipeline() wird unterstützt, nur maven (bisher), alles automatisch | ||
| 73 | |||
| 74 | |||
| |
26.2 | 75 | == Collection Project und Unterprojekte == |
| 76 | |||
| |
27.1 | 77 | TODO |
| 78 | |||
| |
6.1 | 79 | = Users, Projects and Roles = |
| 80 | |||
| |
13.1 | 81 | * Projects, users and their roles in projects are managed in the DevOps Portal, the corresponding functions in Dependency-Track are disabled (UI and API) |
| |
6.1 | 82 | |
| 83 | ⚠ **Note** | ||
| |
13.1 | 84 | Projects in the DevOps portal are mapped to the corresponding subwikis in Dependency-Track. |
| |
6.1 | 85 | |
| |
13.1 | 86 | * When Dependency-Track is added as a tool to an existing or new project, a corresponding subwiki is automatically created. Users assigned to the project in the DevOps Portal are then added to the subwiki with the roles defined in the configuration : |
| |
6.1 | 87 | ** Role mapping: ((( |
| 88 | |=Project Role in DevOps Portal|=Permissions in XWiki | ||
| |
24.1 | 89 | |Admin| POLICY_VIOLATION_ANALYSIS,''VIEW_POLICY_VIOLATION,''VIEW_PORTFOLIO,'VIEW_VULNERABILITY,''VULNERABILITY_ANALYSIS' |
| |
6.1 | 90 | |Master|(% colspan="1" %)Can view, comment, and edit pages, but cannot delete content |
| 91 | |Developer|(% colspan="1" %)Similar to Master | ||
| 92 | |Viewer|Read-only access. Can only view content, no edits or comments allowed | ||
| 93 | |||
| 94 | A detailed description of the XWiki role model can be found [[here>>https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Access%20Rights/Permission%20types/]] | ||
| 95 | ))) | ||
| 96 | |||
| 97 | = Main Features = | ||
| 98 | |||
| |
24.1 | 99 | Inside DevOps-as-a-Service, deptrack is mainly used for writing specifications and documentations. See below for a list of the main features of XWiki. |
| |
6.1 | 100 | |
| 101 | == Collaborative Content Editing == | ||
| 102 | |||
| 103 | * WYSIWYG and wiki syntax editors | ||
| 104 | * Version control and history tracking | ||
| 105 | * Inline and structured content editing | ||
| 106 | * Commenting and annotations | ||
| 107 | |||
| 108 | == Advanced Page & Document Management == | ||
| 109 | |||
| 110 | * Hierarchical page structure (nested pages) | ||
| 111 | * Templates for creating structured documents | ||
| 112 | * Tags, categories, and metadata support | ||
| 113 | * File attachments and preview | ||
| 114 | |||
| 115 | == Powerful Search and Navigation == | ||
| 116 | |||
| 117 | * Full-text search (Solr-based) | ||
| 118 | * Faceted search filters | ||
| 119 | * Page index, breadcrumbs, and navigation panels | ||
| 120 | |||
| 121 | == Macros and Widgets == | ||
| 122 | |||
| 123 | * Built-in and custom macros (charts, galleries, diagrams) | ||
| 124 | * Embedding of rich media (videos, iframes, etc.) | ||
| 125 | * Markdown and LaTeX support | ||
| 126 | |||
| 127 | |||
| 128 | |||
| 129 |