Ce contenu n'est pas disponible dans la langue sélectionnée.
Chapter 1. Frequently asked questions
Do you have questions about Trusted Profile Analyzer? Here is a collection of common questions and their answers to help you understand more about Red Hat’s Trusted Profile Analyzer service.
- Q: What is Red Hat’s Trusted Profile Analyzer service?
- Q: How can I use Red Hat’s Trusted Profile Analyzer service?
- Q: What kind of content will be available with the Trusted Profile Analyzer service?
- Q: What content will be available with the Trusted Profile Analyzer Service Preview release?
- Q: How does a Trusted Profile Analyzer SBOM help me?
- Q: Who is using Red Hat’s Trusted Profile Analyzer service?
- Q: To use Red Hat’s Trusted Profile Analyzer service, do I need to learn anything new, or change my development workflows and processes?
- Q: I am not a Quarkus Java developer, can I still gain any value from Red Hat’s Trusted Profile Analyzer service?
What is Red Hat’s Trusted Profile Analyzer service?
Red Hat’s Trusted Profile Analyzer service is a proactive service that helps you evaluate the security and vulnerability risks of using Open Source Software (OSS) packages and dependencies in your application stack.
How can I use Red Hat’s Trusted Profile Analyzer service?
There are two ways you can use Red Hat’s Trusted Profile Analyzer service. First, by using the Dependency Analytics extension for integrated development environment (IDE) platforms, such as Microsoft’s Visual Studio Code, or Jet Brains' IntelliJ IDEA. Using Dependency Analytics gives you in-line guidance on vulnerabilities as you write your application. Second, by searching for Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) information for Red Hat products on Red Hat’s Hybrid Cloud Console.
What kind of content will be available with the Trusted Profile Analyzer service?
You have access to application libraries for Java, NodeJS, Python, Go, and Red Hat Enterprise Linux packages. Vulnerability information about open source packages comes directly from internal Red Hat resources, Red Hat’s partner ecosystem, such as Snyk, and open source community data sources.
What content will be available with the Trusted Profile Analyzer Service Preview release?
The following content will be available for Service Preview:
- Quarkus Java Framework for Java Archive (JAR) files with associated SBOM files.
- Red Hat Enterprise Linux Universal Base Image (UBI) version 8 and 9 with associated SBOM files.
- Vulnerability information about open source Java packages.
How does a Trusted Profile Analyzer SBOM help me?
A Trusted Profile Analyzer Software Bill of Materials (SBOM) can help you by understanding the software components within an application stack, and any related vulnerabilities those software components can have. An SBOM can improve visibility and transparency of open source code within the software supply chain by component’s provenance, license information, and attestation of how it was built.
Who is using Red Hat’s Trusted Profile Analyzer service?
The primary audience for Red Hat’s Trusted Profile Analyzer service is Quarkus Java developers, and cloud-native container image builders are using the Red Hat Enterprise Linux UBI.
To use Red Hat’s Trusted Profile Analyzer service, do I need to learn anything new, or change my development workflows and processes?
No.
I am not a Quarkus Java developer, can I still gain any value from Red Hat’s Trusted Profile Analyzer service?
Yes. The Trusted Profile Analyzer service still provides security risk information about open source packages that are not currently included in the Trusted Profile Analyzer repository.
