inahomoronyia/repocrawler repository overview

⁠A Software Supply Chain Vulnerabilities Analysis Testbed

Where to file issues: https://github.com/RepoCrawler/repocrawler/issues⁠

⁠How to use this image

• Create a file and save as compose.yml in a project directory of your choice.
• Copy code below into the compose.yml file (Remember to replace <tag> placeholder with the appropriate image tag -see description of image variants below)

  
  services:
    RepoCrawler:
      image: inahomoronyia/repocrawler:<tag>
      container_name: repocrawler_v1
      restart: always
      ports:
        - '3000:3000'
      volumes:
        - RepoCrawlerData:/usr/src/app/db
  volumes:
    RepoCrawlerData:
  
  

  Copy
• From your project directory, start up your application by running docker compose up.
• Enter http://localhost:8080/ in a browser to see the application running.
• You can bring everything down, removing the containers entirely, with the docker compose down command (use the -v option to remove persisted data generated by containers)

⁠Image Variants

1. ⁠repocrawler:<version>

   This is defacto image. It addresses a use case where you have identified a component X you may want to integrate with your system as a dependency. Your interest is to use RepoCrawler to investigate answers to different categories of queries related to X and its supply chain as shown in the table below.
   
   

   	Category	Query
   1.	Composition	What software components is X using?
   2.	Identification	Does your dependencies include component X?
   3.	Maintainability	Which of X component dependencies are end-of-life?
   4.	Completeness	What do you/don’t know about other components that X may be depending on?
   5.	Sensitive Data Mapping	Which sensitive/personal data does component X collect, process or share?
   6.	Data Protection	What data protection measures have component X put in place?
   7.	Pedigree	Where is the lineage of component X?
   8.	Provenance	Where does component X come from?
   9.	License	What is the license of X and its dependencies?
   10.	Maturity Level	What is the maturity level of X CI/CD pipeline?
   11.	Integrity Verification	How do I know X has not been tempered with?
   12.	Services	Which external services (or other components) is X sharing (receiving/sending) data with?
   13.	Vulnerability Remediation	Is vulnerability v exploitable in component X?
   14.	Security Advisories	What are the vulnerabilities in component X?

   RepoCrawler supports you in building a testbed for X to support exploring above queries for different risk profiles. RepoCrawler will search X's repository (e.g Github) and component registries (e.g npm) to discover footprints necessary to understand its supply chain. The most recent version is tagged latest.
2. The second use case is for users who just want to explore how RepoCrawler works and the benefits it provides to better understand the software supply chain. For this class of users, we have two pre-configured sample testbeds.
   • The image tagged demofb is the image of a sample testbed that analyses the supply chain of facebook-nodejs-business-sdk. To access this testbed use credentials - username: demofb and password: demofb
   • Alternative, the image tagged demott is the image of a testbed that analyses the supply chain of tiktok-business-api-sdk. To access this testbed use credentials - username: demott and password: demott.

⁠License

Copyright 2024 Inah Omoronyia

Licensed under Creative Commons, CC BY-SA 4.0; you may not use this image except in compliance with the license. A copy of the license is available at:

 https://creativecommons.org/licenses/by-sa/4.0/⁠

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.