Quick Start Guide

Procedure

1. Open a web browser.
2. Go to the Application Services home page on the Hybrid Cloud Console.
3. If prompted, log in to the Hybrid Cloud Console with your credentials.
4. On the navigation menu, click Trusted Profile Analyzer.
5. A new web browser window opens to the Trusted Profile Analyzer console home page. From the Trusted Profile Analyzer home page, on the navigational menu, click Search.
6. Enter your search criteria into the dialog box to begin your search.

7. On the search results page, you can filter the results by Red Hat products, download SBOM files, view package vulnerability and advisory information, along with any possible remediations.

   Note

   The number shown on the Advisories tab is how many times your search criteria made a match.

Procedure

1. Open a web browser.
2. Go to the Application Services home page on the Hybrid Cloud Console.
3. If prompted, log in to the Hybrid Cloud Console with your credentials.
4. On the navigation menu, click Trusted Profile Analyzer.
5. A new web browser window opens to the Trusted Profile Analyzer console home page.
6. Click SBOMs from the navigation menu.
7. Click the Generate vulnerability report button.
8. You can drag and drop your SBOM file directly to this page, or click the Browse Files button, then choose the SBOM file you want to scan.
9. After RHTPA scans the SBOM file, you get a summary of the analysis, and any specific vulnerability information for the packages included in your SBOM file.

Procedure

1. Open the Visual Studio Code application.
2. From the file menu, click View, and click Extensions.
3. Search the Marketplace for Red Hat Dependency Analytics.
4. Click the Install button to install the extension. Wait for the installation to finish.

5. To start scanning your application for security vulnerabilities, and view the vulnerability report, you can do one of the following:

   • Open a manifest file, hover over a dependency marked by the inline Component Analysis, indicated by the wavy-red line under a dependency name, click Quick Fix, and click Detailed Vulnerability Report.
   • Open a manifest file, and click the pie chart icon.
   • Right click the manifest file in the Explorer view, and click Red Hat Dependency Analytics Report…​.
   • From the vulnerability pop-up alert message, click Open detailed vulnerability report.

6. If you want to exclude specific packages for analysis, you can use the exhortignore as a comment tag for your specific programming language.

   • For Maven, update the pom.xml file:

     ...
     <dependency> <!--exhortignore-->
       <groupId>...</groupId>
       <artifactId>...</artifactId>
       <version>...</version>
     </dependency>
     ...

     Copy to Clipboard Toggle word wrap

   • For Go, update the go.mod file:

     module github.com/trustify-da/SaaSi/deployer
     
     go 1.19
     
     require (
             github.com/davecgh/go-spew v1.1.1 // indirect exhortignore
             github.com/emicklei/go-restful/v3 v3.9.0 // indirect
             github.com/go-logr/logr v1.2.3 // indirect //exhortignore
     
     )
     ...

     Copy to Clipboard Toggle word wrap

   • For Python, update the requirements.txt file:

     ...
     click==8.0.4 #exhortignore
     ...

     Copy to Clipboard Toggle word wrap

   • For Gradle, update the build.gradle file:

     plugins {
     id 'java'
     }
     
     group = 'groupName'
     version = 'version'
     
     repositories {
         mavenCentral()
     }
     
     dependencies {
         implementation "groupId:artifactId:version" // exhortignore
     }
     test {
         useJUnitPlatform()
     }

     Copy to Clipboard Toggle word wrap

Procedure

1. Open the IntelliJ application.
2. From the file menu, click Settings , and click Plugins.
3. Search the Marketplace for Red Hat Dependency Analytics.
4. Click the INSTALL button to install the plugin.

5. To start scanning your application for security vulnerabilities, and view the vulnerability report, you can do one of the following:

   • Open a manifest file, hover over a dependency marked by the inline Component Analysis, indicated by the wavy-red line under a dependency, and click Detailed Vulnerability Report.
   • Right click the manifest file in the Project window, and click Dependency Analytics Report.

6. If you want to exclude specific packages for analysis, you can use the exhortignore as a comment tag for your specific programming language.

   • For Maven, update the pom.xml file:

     ...
     <dependency> <!--exhortignore-->
       <groupId>...</groupId>
       <artifactId>...</artifactId>
       <version>...</version>
     </dependency>
     ...

     Copy to Clipboard Toggle word wrap

   • For Go, update the go.mod file:

     module github.com/trustify-da/SaaSi/deployer
     
     go 1.19
     
     require (
             github.com/davecgh/go-spew v1.1.1 // indirect exhortignore
             github.com/emicklei/go-restful/v3 v3.9.0 // indirect
             github.com/go-logr/logr v1.2.3 // indirect //exhortignore
     
     )
     ...

     Copy to Clipboard Toggle word wrap

   • For Python, update the requirements.txt file:

     ...
     click==8.0.4 #exhortignore
     ...

     Copy to Clipboard Toggle word wrap

   • For Gradle, update the build.gradle file:

     plugins {
     id 'java'
     }
     
     group = 'groupName'
     version = 'version'
     
     repositories {
         mavenCentral()
     }
     
     dependencies {
         implementation "groupId:artifactId:version" // exhortignore
     }
     test {
         useJUnitPlatform()
     }

     Copy to Clipboard Toggle word wrap