Chapter 3. Updating code and viewing security insights After building your component with RHTAP, update your code and review the security insights. 3.1. Updating code Go to the Catalog and select the component that you want to modify. On the Overview tab, select the View Source tab to open your project in GitLab or GitHub. You can also select View Tech Docs to review your project's documentation. The documentation source is in the docs directory in your repository. Updates to these files trigger a pipeline run, which refreshes the Tech Docs. Make changes to your code. Clone your repository. Modify your application. For example, update technical docs, or index.html . Commit and push your changes. Note You can also use GitLab or GitHub UI, to directly update your code within the web interface. For GitLab users only: You have to set up webhooks and secrets in GitLab to automatically trigger pipeline run upon code updates. For information on setting up webhooks and secrets in GitLab, see Setting up GitLab for Security Integrations . 3.2. Viewing the pipeline run Open RHDH, navigate to the Catalog , and select the modified component. Select the CI tab to view the pipeline run details. (Optional) Select the CD tab to gain insights into deployments managed by ArgoCD and GitOps. (Optional) Select the Topology tab to visualize your application's deployment within the development namespace. 3.3. Viewing security insights The system automatically triggers an on-push pipeline when you update your code and push changes. By default, RHTAP uses a standard build pipeline for containerized deployment meeting Software Artifacts (SLSA) level 3 specifications. Figure 3.1. A successful pipeline run The pipeline run performs the following tasks: init : Configures rebuild flags, authentication, and creates an image repository secret. clone-repository : Clones the repository to prepare for the build. build-container : Creates a container image from the source code using Buildah and pushes it to a registry. Generates a Software Bill of Materials (SBOM) to document all components and dependencies. Publishes security artifacts like image signatures and attestations. update-deployment : Updates the GitOps repository to deploy the new image. acs tasks: Runs security checks to ensure compliance with policies. show-sbom : Lists all software components and libraries for transparency. summary : Cleans up resources and provides a summary of the pipeline run. Note Click any task in a pipeline run to view logs. 3.3.1. Advanced Cluster Security tasks ACS tasks in the pipeline succeed only if you have installed and configured ACS during the RHTAP installation process. If ACS is not installed or configured, pipeline skips these tasks. Note For detailed instructions on installing ACS, refer Installing Red Hat Advanced Cluster Security for Kubernetes . If you did not install and configure ACS during the RHTAP installation process, refer Configure ACS . Figure 3.2. The ACS tasks in the pipeline run The pipeline includes three ACS tasks that use roxctl to perform security checks: roxctl image scan - Identifies components and vulnerabilities in the image and returns results in the JSON format. roxctl image check - Verifies build-time security violations in the image. For example, policy such as 'No log4j allowed' or restrictions against including curl, wget, or package managers in production images. roxctl deployment check - Checks for build-time and deploy-time security violations in the YAML deployment files. Visualizing ACS reports In RHDH, under the CI tab, the Pipeline Runs section displays detailed task reports in a structured pop-up interface. The pop-up includes: Advanced Cluster Security (conditionally shown on the availability of ACS tasks): Displays individual tabs for all the ACS tasks, summarizing identified security issues. Others: Provides results from the PipelineRun , for example, IMAGE_URL, and IMAGE_DIGEST . This section displays only if multiple sections (for example, Enterprise Contract or ACS) are available in the pop-up. To view ACS reports: Select Catalog and select the component you want to review. Select the CI tab > Actions column > View output icon and review the detailed ACS reports for the selected component. Figure 3.3. The detailed ACS reports Note If you have the required permissions, you can manage vulnerabilities, policies, and review detailed vulnerability reports for a specific image in the ACS console. For more information, see Viewing the dashboard . Interpreting ACS reports Reports from ACS tasks provide security insights that are critical for maintaining a strong security posture. Here's an example of interpreting roxctl image scan (Image Scan) reports. Use the same approach for roxctl image check (Image Check) and roxctl deployment check (Deployment Check) reports. Vulnerability Breakdown: ACS categorize detected vulnerabilities by severity (Critical, Important, Moderate, Low), status (fixable, non-fixable), and offer a summary of the scan results. This categorization includes the total number of vulnerabilities and components analyzed, alongside specific Common Vulnerabilities and Exposures (CVEs) identified. Details Provided: For each identified vulnerability, the report includes: CVE ID: A unique identifier for the vulnerability. Severity: The level of threat posed by the vulnerability. Component: The software component affected by the vulnerability. Component Version: The version of the affected component. Remediation Suggestions: Recommendations for addressing the vulnerability, including the version in which the vulnerability is fixed, if applicable. 3.3.2. Understanding SBOM The show-sbom task creates a list of all software libraries used in the application. This helps identify vulnerabilities and assess security impacts. Figure 3.4. The show-sbom task in the pipeline run Viewing SBOM Procedures Select Catalog and select a component. Select the CI tab and then select the link icon for the show-sbom task. The system displays the SBOM task logs. Review the SBOM in your browser and search for vulnerabilities such as log4j . Figure 3.5. The SBOM details Downloading an SBOM in the CLI Prerequisites You have installed the Cosign CLI tool. The build-container and show-sbom tasks ran successfully. Procedures Expand the successful pipeline run and select the show-summary task. Search and copy the SBOM image URL, and run the following command on your terminal. Example cosign command USD cosign download sbom <the-sbom-url-you-copied> (Optional) Save the output to a file for detailed analysis: Example cosign command USD cosign download sbom <the-sbom-url-you-copied> > sbom.txt Interpreting SBOMs The SBOM includes information about each library used in your project, such as: The source of the library, author or publisher The library name The library version The license type This information helps ensure individual libraries are safely-sourced, updated, and compliant. Example SBOM { "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220", "version": 1, "metadata": { ... }, "components": [ { "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8", "type": "library", "author": "Armin Ronacher <armin.ronacher@active-4.com>", "name": "Flask", "version": "2.1.0", "licenses": [ { "license": { "id": "BSD-3-Clause" } } ], "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*", "purl": "pkg:pypi/Flask@2.1.0", "properties": [ { "name": "syft:package:foundBy", "value": "python-package-cataloger" ... steps Deploy application and view security insights

Commands:
cosign download sbom <the-sbom-url-you-copied>
cosign download sbom <the-sbom-url-you-copied> > sbom.txt
{ "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220", "version": 1, "metadata": { }, "components": [ { "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8", "type": "library", "author": "Armin Ronacher <armin.ronacher@active-4.com>", "name": "Flask", "version": "2.1.0", "licenses": [ { "license": { "id": "BSD-3-Clause" } } ], "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*", "purl": "pkg:pypi/Flask@2.1.0", "properties": [ { "name": "syft:package:foundBy", "value": "python-package-cataloger"