このコンテンツは選択した言語では利用できません。

Getting Started with Red Hat Advanced Developer Suite - software supply chain

Red Hat Advanced Developer Suite - software supply chain 1.8

Learn how to get started with Red Hat Advanced Developer Suite - software supply chain.

Red Hat Advanced Developer Suite - software supply chain Documentation Team

Abstract

This document provides instructions about using ready-to-use software templates for building applications that are infused with secure supply chain features, such as signatures, attestations, Software Bill of Materials (SBOM), SLSA verification, CVE scanning, and release policy guardrails.

Preface
リンクのコピー

Red Hat Advanced Developer Suite - software supply chain (RHADS - SSC) integrates cutting-edge solutions and a DevSecOps CI/CD framework from inception to deployment. This proactive strategy accelerates developer onboarding and process velocity, ensuring security is effectively embedded into every stage of your development pipeline.

Chapter 1. Development workflow
リンクのコピー

The development workflow involves creating, updating, securing, and deploying applications. It can integrate with various repositories, container registries, and CI/CD tools according to your needs.

Expand

Step	Description
Install RHADS - SSC	Install RHADS - SSC to enable secure and efficient DevSecOps workflows.
Create an application	Use prebuilt templates to create an application. These templates are customizable and include pipelines and configurations to simplify the development process. When creating an application you can choose the following components: GitHub (default), GitLab, or Bitbucket for repositories Quay (default), JFrog Artifactory, or Sonatype Nexus Repository for registries Tekton (default), GitHub Actions, Jenkins CI, or GitLab CI for CI/CD workflows Important If you select Bitbucket, GitLab CI, or Jenkins CI during application setup, you must configure these tools to trigger pipeline runs.
Update an application	Push application updates. The pipeline automatically processes and secures the changes.
View security insights	Pipeline runs provide a visual representation of all tasks, offering insights into security checks and compliance.
Deploy an application	Promote your application from Development to Staging and then to Production environments.
(Optional) Customize templates and pipelines	Modify templates and pipelines to meet your organization’s specific requirements.

After completing this procedure, install Red Hat Advanced Developer Suite - software supply chain. If you have already installed Red Hat Advanced Developer Suite - software supply chain, see creating an application from a template.

Chapter 2. Overview of sample software templates
リンクのコピー

Red Hat Advanced Developer Suite - software supply chain (RHADS - SSC)'s ready-to-customize software templates integrate with the following components to enhance operational security while accelerating application development:

Advanced Cluster Security (ACS): Helps you to identify and reduce vulnerabilities early in the development process.
Quay: Provides a security-enhanced container registry for your container images, and continuously scans each build for security risks to keep your applications safe. You can also use JFrog, or Artifactory instead of Quay.
OpenShift Pipelines: Automates your build and deployment processes, and allows you to customize the processes to your specific requirements.
OpenShift GitOps: Maintains your application configurations in Git repositories, supporting infrastructure as code.

Additionally, RHADS - SSC supports popular programming languages such as Java, Python, JavaScript, and Go.

Note

After installing RHADS - SSC, familiarize yourself with Red Hat Developer Hub and the templates on the Self-sevice page before customizing the templates or creating your own templates. Understanding the default templates might help you understand how RHADS - SSC supports a secure supply chain.

2.1. Creating an application from a software template
リンクのコピー

Use the Red Hat Developer Hub (RHDH) portal to select a software template and create an application.

Prerequisites

Before using a software template to create an application, check to see if you meet the following prerequisites:

You have successfully installed the Red Hat Advanced Developer Suite - software supply chain (RHADS - SSC).
You log in to the Red Hat Developer Hub (RHDH). Use the Red Hat Developer Hub link the RHADS - SSC installation program provides at the end of the installation process.
You configure Jenkins with the appropriate credentials if you integrated Jenkins when installing RHADS - SSC.
You meet the following prerequisites if you integrated Bitbucket when installing RHADS - SSC so that Red Hat OpenShift GitOps can create a git repository at the correct location:
- Create a project in a Bitbucket workspace.
- Create an app password in Bitbucket.

Procedure

On the RHDH portal, select the ⊕ icon to navigate to the Self-service page.
Select a suitable template (for example, Quarkus Java - Trusted Application Pipeline).
Configure the template in the following form fields in the "Application Information" view (step 1 of 4):
1. Enter an application name in the Name field. The name can incorporate lowercase letters (a-z), numbers (0-9), and dashes (-). However, it must start and end with a lowercase alphanumeric character. Examples of valid names are my-name or abc-123. The length must range from 1 to 63 characters.
2. Select an appropriate RHDH component owner from the Owner drop-down list. The default value is user:guest. If you have not registered an owner, retain the default user:guest selection. You can replace guest with your username to personalize ownership of the application.
3. Select Next. The system displays the Application Repository Information form (step 2 of 4).

Configure the git repository information:

Select a repository host type from the Host Type drop-down list:
- GitHub
- GitLab
- Bitbucket
Enter a repository name using A-Z, a-z, 0-9, underscore (_), and dash (-) characters in the Repository Name field. The system uses this name for the repository it creates on the host repository server.
Enter the name of the default branch for your repository in the Repository Default Branch field. The default is main, but you can specify a different branch name.
Specify the username, organization name, or project within an organization that owns the Git repository in the Repository Owner field.

Enter the domain name of the Git repository server in the Repository Server field:

Expand

Git repository server	Description
GitHub	The field is pre-populated with `github.com` if you selected GitHub as the Host Type. However, you can enter your on-premise host URL without the `HTTP` protocol and without the `.git` extension. For example, `github-github.apps.<custer_name>.<domain_name>`.
GitLab	The field is pre-populated with `gitlab.com` if you selected GitLab as the Host Type. However, you can enter your on-premise host URL without the `HTTP` protocol and without the `.git` extension. For example, `gitlab-gitlab.apps.<custer_name>.<domain_name>`.
Bitbucket	The field is pre-populated with `bitbucket.org`.

Configure the following fields for Bitbucket:
1. Enter the name of your workspace that contains your project in the Workspace field.
2. Enter the project key in the Project field. The project key is located next to the project name in Bitbucket.

Select the continuous integration (CI) tool that the system uses to build, test, and deploy the application from the CI Provider drop-down list:

Expand

Git repo host	Available CI providers
Bitbucket	Jenkins (SLSA 2) Tekton (SLSA 3) Azure Pipelines (SLSA2) (Technology Preview)
GitHub	Jenkins (SLSA 2) GitHub Actions (SLSA 2) Tekton (SLSA 3) Azure Pipelines (SLSA2) (Technology Preview)
GitLab	Jenkins (SLSA 2) GitLab CI (SLSA 2) Tekton (SLSA 3)

Important

If you use Bitbucket as your source repository with Tekton CI, you must add a webhook in Bitbucket.
If you use GitLab as your source repository with Tekton CI, you must add a webhook in GitLab.
If you use GitHub Actions, you must configure the required secrets in GitHub.
If you use GitLab CI, you must configure the required secrets in GitLab.
If you use Azure Pipelines, you must configure the required secrets in Azure.
If you use Jenkins, you must add your application to Jenkins.

Enter the name of the Azure project where RHADS - SSC runs the pipeline in the Azure Project field if Azure Pipelines is your CI provider.
Select Next. The system displays the Deployment Information form (step 3 of 4).

Configure the Deployment Information:
1. Specify the image registry URL without the HTTP protocol in the Image Registry field. Supported registries include Quay (for example, quay.io), JFrog Artifactory (for example, tssc.jfrog.io), and Sonatype Nexus Repository (for example, nexus.mycompany.com).
2. Enter the image organization name into the Image Organization field.
3. Enter an image name using only lowercase letters, digits, and separators in the Image Name field. Separators include a period (.), up to two underscores (_), or one or more hyphens (-). For example, my-app_1.2.
  Note
  You must ensure that the name does not start or end with a separator.
4. Enter the prefix for the namespaces or cluster where you intend to deploy your application in the Deployment Namespace field. The default value is tssc-app. RHADS - SSC creates the namespaces as tssc-app-development, tssc-app-stage, and tssc-app-prod when using tssc-app as the prefix.
Note
tssc-app is the default deployment namespace prefix. You can customize this prefix. For instructions on how to customize the default deployment namespace prefix, refer to Customizing sample software templates.
1. Select Review to review all the information that you added (step 4 of 4).
2. Select Create. RHADS - SSC initiates automated tasks to set up your application’s infrastructure and deployment pipeline, including:
  - Repository Creation and Configuration: Creates a new repository in your specified hosting service, including the GitOps repository and the source repository.
  - Namespace Creation: Generates namespaces for development, staging, and production environments.
  - GitOps Integration: Creates and configures Red Hat OpenShift GitOps (GitOps) (a.k.a., Argo CD) resources to orchestrate the deployment of your application across the development, staging, and production namespaces.
  - Pipeline Definition: Adds a pipeline definition, providing a "Pipelines as Code" model for building, testing, and deploying your application.

2.2. Reviewing the application after creation
リンクのコピー

Immediately after using a template to create an application, you can review the application’s components by clicking the links in the Red Hat Developer Hub (RHDH) "Run of <application_name>" page view.

Procedure

Click Source Repository to view the application’s source code repository.
Click GitOps Repository to view the application’s GitOps configuration repository.
Click Open Component in Catalog to view the application’s components.
1. Click View Source on the About card of the Overview tab to open the source code repository.
2. Click <application_name>-ci, <application_name>-development, <application_name>-stage, or <application_name>-prod under Deployment Summaries to view the application components across namespaces in Red Hat OpenShift GitOps (GitOps).
3. Click a commit ID from the Revision column under Deployment Summaries to review changes in the application’s git repository.
4. Select View Tech Docs on the About card of the Overview tab to view the technical documentation for your application, providing detailed insights into the application’s features, configuration steps, and usage.
Click Open GitOps in Catalog to view the GitOps repository in the catalog.

2.3. Unregistering an application
リンクのコピー

This process removes the application’s source and GitOps repository from your catalog and resource view, essentially hiding it. The application remains functional within the cluster. Since the underlying source and GitOps repositories are not removed, you can reregister unregistered applications at any time.

Procedure

Navigate to the Catalog and select the component that you want to unregister.
Select vertical three-dot menu associated with the component, and then select Unregister entity. The system displays a confirmation dialog box.

View larger image
Select Unregister Location. This removes the application’s Git repository from your catalog view.
Navigate to the Catalog, from the Kind drop-down list, select Resource, and then unregister the corresponding GitOps resource.
Remove the application from the cluster, by running the following command:
```
oc delete application your-app-name-app-of-apps -n tssc-gitops
```
```
oc delete application your-app-name-app-of-apps -n tssc-gitops
```
Copy to Clipboard Toggle word wrap
- Replace tssc-gitops with your namespace if different, and your-app-name with the name of your application.

Chapter 3. Updating the application source code
リンクのコピー

You can update the application’s source code to trigger a new pipeline run. Red Hat OpenShift GitOps (GitOps) deploys your application with security insights based on the latest version of your code.

Procedure

Go to the Catalog and select the component you want to update.
On the Overview tab, select View Source to open the project in your Git repository.
Optionally, select View Tech Docs to open the project’s documentation. The source is located in the docs/ directory of your repository. Updates to this directory trigger a pipeline run to refresh the Tech Docs.
Modify to your code:
1. Make a clone your repository.
2. Modify at least one source code file.
3. Create a commit and push your changes.
  Note
  You can also use the Git repository’s UI to make code changes directly in your browser.
  For GitLab and Bitbucket users: To trigger pipeline runs automatically after code updates, you must set up webhooks and secrets in GitLab or Bitbucket.
  For instructions on setting up webhooks in GitLab and Bitbucket, see Configuring webhooks in GitLab and Bitbucket.
  For instructions on setting up secrets in GitLab, see: Configuring GitLab CI.
  For instructions on setting up secrets in Bitbucket, see: Configuring Jenkins.

Chapter 4. Viewing security insights
リンクのコピー

Red Hat Advanced Developer Suite - software supply chain (RHADS - SSC) automatically triggers an on-push pipeline when you update your code and push changes. By default, it uses a standard build pipeline for containerized deployment according to the Software Artifacts (SLSA) level 3 specifications.

Figure 4.1. A successful pipeline run

The pipeline run performs the following tasks:

init: Configures rebuild flags and authentication. Creates an image repository secret.
clone-repository: Clones the repository to prepare for the build.
build-container:
- Creates a container image from the source code using Buildah and pushes it to a registry.
- Generates a Software Bill of Materials (SBOM) to document all components and dependencies.
- Publishes security artifacts like image signatures and attestations.
update-deployment: Updates the GitOps repository to deploy the latest image.
acs-image-check, acs-image-scan, and acs-deploy-check tasks: Each task runs a security check to ensure compliance with policies.
show-sbom: Creates a complete list of the software components and libraries for transparency purposes.
summary: Cleans up resources and provides a summary of the pipeline run.

Note

Click any task in a pipeline run to view logs.

Prerequisites

The build-container and show-sbom tasks ran successfully (for downloading the SBOM).

Procedure

Select Catalog.
Select the component you want to review.
Select the CI tab > Actions column > View output icon.
Review the detailed RHACS reports for the selected component.
Figure 4.2. The detailed RHACS reports

View larger image

Note
If you have the required permissions, you can manage vulnerabilities, policies, and review detailed vulnerability reports for a specific image in the RHACS console. For more information, see Viewing the dashboard.
Select the CI tab.
Select the link icon for the show-sbom task. The UI displays the SBOM task logs.
Review the SBOM in your browser and search for vulnerabilities such as log4j.
Figure 4.3. The SBOM details

View larger image
(Optional) To download the SBOM in the CLI: Expand the successful pipeline run and select the show-summary task.
Search and copy the SBOM image URL.
Run the following command on your terminal:
```
cosign download sbom <the_sbom_url_you_copied>
```
```
$ cosign download sbom <the_sbom_url_you_copied>
```
Copy to Clipboard Toggle word wrap
(Optional) To save the output to a file for detailed analysis, run the following command:
```
cosign download sbom <the_sbom_url_you_copied> > sbom.txt
```
```
$ cosign download sbom <the_sbom_url_you_copied> > sbom.txt
```
Copy to Clipboard Toggle word wrap

4.1. About Red Hat Advanced Cluster Security reports
リンクのコピー

Reports from RHACS tasks give you security insights to help you maintain strong security.

Interpreting roxctl image scan (Image Scan) reports involve the following information:

Vulnerability Breakdown: RHACS categorizes detected vulnerabilities by severity (Critical, Important, Moderate, Low), and status (fixable, nonfixable). Then, it offers a summary of the scan results. This categorization includes the total number of vulnerabilities and components analyzed with specific Common Vulnerabilities and Exposures (CVEs) identified.
Details Provided: For each identified vulnerability the report includes:
- CVE ID: A unique identifier for the vulnerability.
- Severity: The level of threat posed by the vulnerability.
- Component: The software component affected by the vulnerability.
- Component Version: The version of the affected component.
- Remediation Suggestions: Recommendations for addressing the vulnerability, including the fixed version if available.

You can use the same approach for roxctl image check (Image Check) and roxctl deployment check (Deployment Check) reports.

4.2. About pipeline security tasks
リンクのコピー

When you install and configure the Red Hat Advanced Cluster Security (RHACS) during Red Hat Advanced Developer Suite - software supply chain )RHADS - SSC) installation, the pipeline runs security tasks. Otherwise, the pipeline skips these steps.

Note

For detailed instructions on installing RHACS, refer Installing Red Hat Advanced Cluster Security for Kubernetes.
If you did not install and configure RHACS during the RHADS - SSC installation process, refer Configure ACS.

Figure 4.4. The RHACS tasks in the pipeline run

Three RHACS pipeline tasks use roxctl to run security checks:

roxctl image scan: Identifies components and vulnerabilities in the image and generates results in JSON format.
roxctl image check: Verifies build-time security violations in the image. For example, policies such as 'No log4j allowed' or restrictions against including curl, wget, or package managers in production images.
roxctl deployment check: Checks for build-time and deploy-time security violations in the YAML deployment files.

The Pipeline Runs section under the CI tab in RHDH displays detailed task reports. The pop-up interface displays the following items:

Red Hat Advanced Cluster Security (conditionally shown on the availability of RHACS tasks): Displays individual tabs for all the RHACS tasks, summarizing identified security issues.
Others: Provides results from the PipelineRun. For example, IMAGE_URL, and IMAGE_DIGEST. The UI only displays this section when the pop-up contains additional information (for example, Conforma or RHACS).

4.3. About Software Bill of Materials (SBOMs)
リンクのコピー

The show-sbom task creates a list of all software libraries used in the application. This list helps identify vulnerabilities and assess security impacts.

Figure 4.5. The show-sbom task in the pipeline run

The SBOM includes information about each library used in your project, such as:

The source of the library, author, or publisher
The library name
The library version
The license type

This information helps ensure that you use safely-sourced, updated, and compliant libraries. The following JSON file is a partial example of an SBOM:

{
    "bomFormat": "CycloneDX",
    "specVersion": "1.4",
    "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220",
    "version": 1,
    "metadata": {
        ...
    },
    "components": [
        {
            "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8",
            "type": "library",
            "author": "Armin Ronacher <armin.ronacher@active-4.com>",
            "name": "Flask",
            "version": "2.1.0",
            "licenses": [
                {
                    "license": {
                        "id": "BSD-3-Clause"
                    }
                }
            ],
            "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*",
            "purl": "pkg:pypi/Flask@2.1.0",
            "properties": [
                {
                    "name": "syft:package:foundBy",
                    "value": "python-package-cataloger"
                    ...

{
    "bomFormat": "CycloneDX",
    "specVersion": "1.4",
    "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220",
    "version": 1,
    "metadata": {
        ...
    },
    "components": [
        {
            "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8",
            "type": "library",
            "author": "Armin Ronacher <armin.ronacher@active-4.com>",
            "name": "Flask",
            "version": "2.1.0",
            "licenses": [
                {
                    "license": {
                        "id": "BSD-3-Clause"
                    }
                }
            ],
            "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*",
            "purl": "pkg:pypi/Flask@2.1.0",
            "properties": [
                {
                    "name": "syft:package:foundBy",
                    "value": "python-package-cataloger"
                    ...

Copy to Clipboard

Toggle word wrap

Chapter 5. Promoting a build
リンクのコピー

The OpenShift GitOps Operator uses Argo CD to enable continuous deployment by using your git repository as a single source of truth for infrastructure configurations. When you update your git repository, Argo CD deploys the application update across development, staging, and production environments.

Note

The promotion procedures provide an example deployment workflow. Customize it to fit your organization’s requirements.

Promote a build by updating your git repository.

Procedure

In Red Hat Developer Hub (RHDH), select Catalog.
From the Kind drop-down list, select Resource, and then select a git repository.
Open the Overview tab and select View Source to access the repository.
(Optional) Alternatively, select Catalog, open the Overview tab, and select View TechDocs.
1. In the Home > Repository section, select the git repository.
Clone your git repository.
Note
Ensure that the local clone is up-to-date.
Create a new branch.
Navigate to the component/<app_name>/overlays directory, which contains subdirectories for development, stage, and prod.

Follow the steps in the table to promote the application:

Expand

To move your application Do this

To move your application	Do this
From development to stage environment	Open the `development/deployment-patch.yaml` file and copy the container image URL (for example, `quay.io/<username>/imageName:imageHash`). Open the `stage/deployment-patch.yaml` file and replace the container image URL with the one you copied. Note To include additional configuration changes (for example, replicas), copy them from the `development/deployment-patch.yaml` file to the `stage/deployment-patch.yaml` file.
From stage to production environment	Open the `stage/deployment-patch.yaml` file and copy the containers image URL (for example, `quay.io/<username>/imageName:imageHash`). Open the `prod/deployment-patch.yaml` file and replace the container image URL with the one you copied. Note To include additional configuration changes (for example, replicas), copy them from the `stage/deployment-patch.yaml` file to the `prod/deployment-patch.yaml` file.

From development to stage environment

Open the development/deployment-patch.yaml file and copy the container image URL (for example, quay.io/<username>/imageName:imageHash).
Open the stage/deployment-patch.yaml file and replace the container image URL with the one you copied.

Note

To include additional configuration changes (for example, replicas), copy them from the development/deployment-patch.yaml file to the stage/deployment-patch.yaml file.

From stage to production environment

Open the stage/deployment-patch.yaml file and copy the containers image URL (for example, quay.io/<username>/imageName:imageHash).
Open the prod/deployment-patch.yaml file and replace the container image URL with the one you copied.

Note

To include additional configuration changes (for example, replicas), copy them from the stage/deployment-patch.yaml file to the prod/deployment-patch.yaml file.

Commit and push your updates.
Create a pull request (PR) to start a promotion pipeline. The pipeline validates the changes against Conforma policies.
1. Check the pipeline run in the CI tab of RHDH.
Merge the PR to trigger Argo CD, which applies the changes and promotes the build to the next environment.

Verification

Use the Topology tab in RHDH to confirm the application distribution across namespaces.
Use the CD tab to view deployment details, including the status, updates, commit message (for example, "Promote stage to prod"), and container image changes.

5.1. About Conforma compliance
リンクのコピー

Conforma is a suite of tools designed to maintain software supply chain security. It helps maintain the integrity of container images by verifying that they meet defined requirements before promoting them to production. If an image does not comply with the set policies, Conforma generates a report identifying the issues that must be resolved.

The promotion pipeline includes several tasks to ensure secure and compliant deployments:

git-clone: Clones the repository into the workspace using the git-clone task.
gather-deploy-images: Extracts the container images from deployment YAML files for validation.
verify-enterprise-contract: Validates the container images using Conforma policies and Sigstore’s cosign tool.
deploy-images: Deploys images to the target environment.
download-sbom-from-url-in-attestations: Retrieves software bill of materials (SBOMs) for images by downloading OCI blobs referenced in image attestations.
upload-sbom-to-trustification: Uploads SBOMs to Trustification using the BOMbastic API.

The Red Hat Advanced Developer Suite - software supply chain build process generates a signed in-toto attestation of the build pipeline, which cryptographically verifies the build’s integrity. Conforma then evaluates the build against defined policies, ensuring it complies with the organizational security standards.

The insights from Conforma compliance reports help prioritize security and compliance tasks:

Review policy compliance: Confirm that your application meets standards such as Supply Chain Levels for Software Artifacts (SLSA). Address any compliance gaps based on the recommendations in the report.
Streamline review: Use filters in the reports to focus on critical issues, enabling a faster and more efficient review process.

Conforma compliance reports provide detailed insights into application security and adherence to policies:

Policy compliance overview: Displays the checks performed, their status, (success, warning, or failure), and messages explaining warnings or failures.
Details provided: Policy reports detail:
- Successful checks: Lists the policies that passed validation.
- Warnings and failures: Highlights policies that triggered warnings or failed checks, with explanations.
- Rule compliance: Shows how the application adheres to individual policy rules, such as source code references or attestation validations.

5.2. Viewing Conforma compliance reports
リンクのコピー

The Pipeline Runs section, located under the CI tab in Red Hat Developer Hub, displays detailed compliance reports in a structured pop-up interface.

Procedure

Follow the steps that correspond to your CI provider:

Expand

CI Provider	Steps	Report Display
Tekton (default CI provider)	Select Catalog and select the component you want to review. Select the CI tab, and in the Actions column, select the View output icon.	The report displays in a structured pop-up interface.
Other CI providers (for example, Jenkins or GitLab)	Navigate to the application’s build logs. Search for the text `Step: verify-enterprise-contract`.	The report is displayed in the build logs.

Figure 5.1. The Conforma report (Tekton example)

Revised on 2026-02-04 23:24:05 UTC

Legal Notice
リンクのコピー

The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.

Linux® is the registered trademark of Linus Torvalds in the United States and other countries.

Java® is a registered trademark of Oracle and/or its affiliates.

XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.

MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.

Node.js® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.

The OpenStack® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.

All other trademarks are the property of their respective owners.

このコンテンツは選択した言語では利用できません。

Getting Started with Red Hat Advanced Developer Suite - software supply chain

Learn how to get started with Red Hat Advanced Developer Suite - software supply chain.

Preface
リンクのコピー

Chapter 1. Development workflow
リンクのコピー

Chapter 2. Overview of sample software templates
リンクのコピー

2.1. Creating an application from a software template
リンクのコピー

2.2. Reviewing the application after creation
リンクのコピー

2.3. Unregistering an application
リンクのコピー

Chapter 3. Updating the application source code
リンクのコピー

Chapter 4. Viewing security insights
リンクのコピー

4.1. About Red Hat Advanced Cluster Security reports
リンクのコピー

4.2. About pipeline security tasks
リンクのコピー

4.3. About Software Bill of Materials (SBOMs)
リンクのコピー

Chapter 5. Promoting a build
リンクのコピー

5.1. About Conforma compliance
リンクのコピー

5.2. Viewing Conforma compliance reports
リンクのコピー

Legal Notice
リンクのコピー

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

多様性を受け入れるオープンソースの強化

会社概要

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

このコンテンツは選択した言語では利用できません。

Getting Started with Red Hat Advanced Developer Suite - software supply chain

Learn how to get started with Red Hat Advanced Developer Suite - software supply chain.

Prefaceリンクのコピーリンクがクリップボードにコピーされました!

Chapter 1. Development workflowリンクのコピーリンクがクリップボードにコピーされました!

Chapter 2. Overview of sample software templatesリンクのコピーリンクがクリップボードにコピーされました!

2.1. Creating an application from a software templateリンクのコピーリンクがクリップボードにコピーされました!

2.2. Reviewing the application after creationリンクのコピーリンクがクリップボードにコピーされました!

2.3. Unregistering an applicationリンクのコピーリンクがクリップボードにコピーされました!

Chapter 3. Updating the application source codeリンクのコピーリンクがクリップボードにコピーされました!

Chapter 4. Viewing security insightsリンクのコピーリンクがクリップボードにコピーされました!

4.1. About Red Hat Advanced Cluster Security reportsリンクのコピーリンクがクリップボードにコピーされました!

4.2. About pipeline security tasksリンクのコピーリンクがクリップボードにコピーされました!

4.3. About Software Bill of Materials (SBOMs)リンクのコピーリンクがクリップボードにコピーされました!

Chapter 5. Promoting a buildリンクのコピーリンクがクリップボードにコピーされました!

5.1. About Conforma complianceリンクのコピーリンクがクリップボードにコピーされました!

5.2. Viewing Conforma compliance reportsリンクのコピーリンクがクリップボードにコピーされました!

Legal Noticeリンクのコピーリンクがクリップボードにコピーされました!

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

多様性を受け入れるオープンソースの強化

会社概要

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

Preface
リンクのコピー

Chapter 1. Development workflow
リンクのコピー

Chapter 2. Overview of sample software templates
リンクのコピー

2.1. Creating an application from a software template
リンクのコピー

2.2. Reviewing the application after creation
リンクのコピー

2.3. Unregistering an application
リンクのコピー

Chapter 3. Updating the application source code
リンクのコピー

Chapter 4. Viewing security insights
リンクのコピー

4.1. About Red Hat Advanced Cluster Security reports
リンクのコピー

4.2. About pipeline security tasks
リンクのコピー

4.3. About Software Bill of Materials (SBOMs)
リンクのコピー

Chapter 5. Promoting a build
リンクのコピー

5.1. About Conforma compliance
リンクのコピー

5.2. Viewing Conforma compliance reports
リンクのコピー

Legal Notice
リンクのコピー