Build an application and view security insights

Prepare your environment

1. Set your project ID as an environment variable:

     export 
     
    PROJECT_ID 
    =$ 
    ( 
    gcloud 
     
    config 
     
    get 
     
    project 
    ) 
    
   

2. Clone the repository that contains the Java code sample to build and containerize:

    git clone https://github.com/googlecloudplatform/software-delivery-shield-demo-java.git
   cd software-delivery-shield-demo-java/backend 
   

Create the Artifact Registry repository for your image

1. Create a new Docker repository named containers in the location us-central1 with the description "Docker repository":

    gcloud artifacts repositories create containers \
       --repository-format=docker \
       --location=us-central1 --description="Docker repository" 
   

2. Verify that your repository was created:

    gcloud artifacts repositories list 
   

   You should see containers in the list of displayed repositories.

Build the application

Build and containerize the Java application using Cloud Build. The following command builds and containerizes the Java application and stores the built container in the Artifact Registry docker repository:

  gcloud 
  
 builds 
  
 submit 
  
 -- 
 config 
 = 
 cloudbuild 
 . 
 yaml 
  
 -- 
 region 
 = 
 us 
 - 
 central1 
 

After the build completes, you see a success status message similar to the following:

 <pre class="none lang-sh">
DONE
-----------------------------------------------------------------------------
ID: 3e08565f-7f57-4449-bc68-51c46cf33d03
CREATE_TIME: 2022-09-19T15:41:07+00:00
DURATION: 54S
SOURCE: gs://sds-docs-project_cloudbuild/source/1663602066.777581-6ebe4b2d6fd741ffa18936d7f78055e9.tgz
IMAGES: us-central1-docker.pkg.dev/sds-docs-project/containers/java-guestbook-backend:quickstart
STATUS: SUCCESS
</pre> 

Generate an SBOM for the built image

An SBOM is a full inventory of an application, identifying the packages your software relies on. The contents can include third-party software from vendors, internal artifacts, and open source libraries.

Generate the SBOM for the image you built in the previous section:

  gcloud 
  
 artifacts 
  
 sbom 
  
 export 
  
\  
 -- 
 uri 
 = 
 us 
 - 
 central1 
 - 
 docker 
 . 
 pkg 
 . 
 dev 
 /$ 
 { 
 PROJECT_ID 
 } 
 / 
 containers 
 / 
 java 
 - 
 guestbook 
 - 
 backend 
 : 
 quickstart 
 

View security insights

The Cloud Build UI in the Google Cloud console contains the Security insightspanel that displays security information related to the build such as SLSA level, any vulnerabilities in the dependencies, and build provenance.

To view the Security insightspanel:

1. Open the Build historypage in the Google Cloud console:

   Open the Build history page

2. Select your project and click Open.

3. In the Regiondrop-down menu, select us-central1.

4. In the table with the builds, locate the row with the build you just executed.

5. Under the Security insightscolumn click View.

You see the Security insightspanel for the build:

This panel displays the following information:

• SLSA Level:This build has achieved SLSA Level 3. Click the Learn morelink to learn what this security level means.

• Vulnerabilities:Any vulnerabilities found in your artifacts. Click the image name ( java-guestbook-backend) to see the artifacts that have been scanned for vulnerabilities.

• Dependenciesfor the built container image in Artifact Registry.

• Build details:Details of the build such as the builder and the link to view logs.