"Cloud Native Buildpacks transform your application source code into images that can run on any cloud." (buildpacks.io)
The pack CLI is "a tool maintained by the Cloud Native Buildpacks project to support the use of buildpacks".
pack build band-service \
--builder docker.io/paketobuildpacks/builder-jammy-buildpackless-tiny \
--buildpack gcr.io/paketo-buildpacks/java \
--env BP_JVM_VERSION=21Spring Boot includes support for Cloud Native Buildpacks directly for both Maven and Gradle.
./gradlew bootBuildImageInstall gitsgin:
brew install sigstore/tap/gitsignConfigure your application repository to enforce commit signing with gitsign:
cd <your_repository_path>
# Sign all commits
git config --local commit.gpgsign true
# Sign all tags
git config --local tag.gpgsign true
# Use gitsign for signing
git config --local gpg.x509.program gitsign
# gitsign expects x509 args
git config --local gpg.format x509The first time you commit code, a browser window will open and ask you to authenticate with Sigstore following the OIDC protocol. For example, you can authenticate via your GitHub account.
You can verify a commit as follows:
git verify-commit HEADAfter packaging the currente application as an OCI image, cosign is used to sign the artifact and the SLSA attestation.
Using cosign, you can display the supply chain security related artifacts for the ghcr.io/thomasvitale/band-service images. Use the specific digest you'd like to verify.
cosign tree ghcr.io/thomasvitale/band-serviceThe result:
📦 Supply Chain Security Related artifacts for an image: ghcr.io/thomasvitale/band-service
└── 💾 Attestations for an image tag: ghcr.io/thomasvitale/band-service:sha256-53b8f5bcec33facefcdaa676edeb6c2cdf88b9c1a1bc0f4d0cd23720b4511e1c.att
└── 🍒 sha256:0b608efeb00a3bfff29e34535779c84d506d4b64b1c39084ed61ace01473b5cd
└── 🔐 Signatures for an image tag: ghcr.io/thomasvitale/band-service:sha256-53b8f5bcec33facefcdaa676edeb6c2cdf88b9c1a1bc0f4d0cd23720b4511e1c.sig
└── 🍒 sha256:3714100d8c0ae7a088de5f6a548fa5a28969594fce1b958c4168876741cc750bYou can verify the signature and its claims:
cosign verify \
--certificate-identity-regexp https://github.com/ThomasVitale \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/thomasvitale/band-service | jqYou can also verify the SLSA Provenance attestation associated with the image.
cosign verify-attestation --type slsaprovenance \
--certificate-identity-regexp https://github.com/slsa-framework \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/thomasvitale/band-service | jq .payload -r | base64 --decode | jqYou can generate a SBOM with Syft as follows:
syft band-serviceTo include also the materials excluded from the final container representation, use this command:
syft band-service --scope all-layersYou can export SBOM in Syft, SPDX, and CycloneDX formats.
syft band-service -o cyclonedx-jsonWhen using Paketo Buildpacks, Syft is already used as part of the build process and SBOMs are generated for each layer. You can access the SBOMs per layer with the following command.
pack sbom download band-service --output-dir sbomsTo learn more about Cloud Native Buildpacks and SBOMs:
You can scan source code with Trivy as follows:
trivy fs .You can also scan a container image:
trivy image <image>Gradle lets you lock all the dependencies in your project and fail a build is any of them is changed outside the standard lifecycle.
You can generate/update the list of locked dependencies as follows:
./gradlew dependencies --write-locksYou can use Gradle to verify checksums and signatures of all the dependencies used in your project.
First, run this command for Gradle to download checksums and signatures:
./gradlew --write-verification-metadata pgp,sha256When building the project, Gradle will ensure the dependencies have not been tampered with:
./gradlew build