OWASP Dependency-Track

# Create directories
mkdir dependency-track && cd dependency-track

# Download Docker Compose file
curl -LO https://dependencytrack.org/docker-compose.yml

# Start the platform
docker compose up -d

# Access at http://localhost:8080
# Default credentials: admin / admin

# docker-compose.yml
version: '3.8'
services:
  dtrack-api:
    image: dependencytrack/apiserver:latest
    environment:
      - ALPINE_DATABASE_MODE=external
      - ALPINE_DATABASE_URL=jdbc:postgresql://postgres:5432/dtrack
      - ALPINE_DATABASE_DRIVER=org.postgresql.Driver
      - ALPINE_DATABASE_USERNAME=dtrack
      - ALPINE_DATABASE_PASSWORD=changeme
    volumes:
      - dtrack-data:/data
    ports:
      - "8081:8080"

  dtrack-frontend:
    image: dependencytrack/frontend:latest
    environment:
      - API_BASE_URL=http://localhost:8081
    ports:
      - "8080:8080"

  postgres:
    image: postgres:15
    environment:
      - POSTGRES_DB=dtrack
      - POSTGRES_USER=dtrack
      - POSTGRES_PASSWORD=changeme
    volumes:
      - postgres-data:/var/lib/postgresql/data

volumes:
  dtrack-data:
  postgres-data:

# Generate SBOM with Syft
syft dir:./my-project -o cyclonedx-json > sbom.json

# Upload via CLI tool
dtrack-cli sbom upload \
  --server http://localhost:8080 \
  --api-key $DTRACK_API_KEY \
  --project "My Project" \
  --version "1.0.0" \
  --sbom sbom.json

# Upload via curl
curl -X POST http://localhost:8080/api/v1/bom \
  -H "X-Api-Key: $DTRACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d @sbom.json

name: SBOM Upload to Dependency-Track
on:
  push:
    branches: [main]

jobs:
  sbom-upload:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          output-file: sbom.json

      - name: Upload to Dependency-Track
        uses: DependencyTrack/gh-upload-sbom@v3
        with:
          server-url: ${{ secrets.DTRACK_URL }}
          api-key: ${{ secrets.DTRACK_API_KEY }}
          project-name: ${{ github.repository }}
          project-version: ${{ github.sha }}
          sbom-file: sbom.json

stages:
  - build
  - security

generate-sbom:
  stage: build
  image: anchore/syft:latest
  script:
    - syft dir:. -o cyclonedx-json > sbom.json
  artifacts:
    paths:
      - sbom.json

upload-sbom:
  stage: security
  image: curlimages/curl:latest
  script:
    - |
      curl -X POST "${DTRACK_URL}/api/v1/bom" \
        -H "X-Api-Key: ${DTRACK_API_KEY}" \
        -H "Content-Type: application/json" \
        -d @sbom.json
  dependencies:
    - generate-sbom

pipeline {
    agent any
    stages {
        stage('Generate SBOM') {
            steps {
                sh 'syft dir:. -o cyclonedx-json > sbom.json'
            }
        }
        stage('Upload to Dependency-Track') {
            steps {
                dependencyTrackPublisher(
                    artifact: 'sbom.json',
                    projectName: 'My Project',
                    projectVersion: "${BUILD_NUMBER}",
                    synchronous: true
                )
            }
        }
    }
}