Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Crie uma aplicação e veja informações de segurança
Este início rápido explica como criar uma aplicação e ver informações de segurança
para a compilação no painel Informações de segurança na Google Cloud consola.
Vai:
Crie e coloque num contentor uma aplicação Java com o Cloud Build e envie
a imagem do contentor para o repositório Docker do Artifact Registry.
Veja as seguintes estatísticas de segurança para a compilação:
Lista de materiais de software (SBOM) para os artefactos de compilação.
Crie a proveniência, que é uma coleção de metadados validáveis sobre uma compilação. Inclui detalhes como os resumos das imagens criadas, as localizações das fontes de entrada, a cadeia de ferramentas de compilação, os passos de compilação e a duração da compilação.
Antes de começar
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
Deve ver containers na lista de repositórios apresentados.
Crie a aplicação
Crie e coloque a aplicação Java num contentor com o Cloud Build.
O comando seguinte cria e coloca a aplicação Java num contentor e
armazena o contentor criado no repositório Docker do Artifact Registry:
Uma SBOM é um inventário completo de uma aplicação que identifica os pacotes dos quais o seu software depende. Os conteúdos podem incluir software de terceiros de fornecedores, artefactos internos e bibliotecas de código aberto.
Gere a SBOM para a imagem que criou na secção anterior:
A IU do Cloud Build na Google Cloud consola contém o painel
Estatísticas de segurança, que apresenta informações de segurança relacionadas com a
compilação, como o nível SLSA, quaisquer vulnerabilidades nas dependências e a
proveniência da compilação.
Para ver o painel Estatísticas de segurança:
Abra a página Histórico de compilações na Google Cloud consola:
Na tabela com as compilações, localize a linha com a compilação que acabou de executar.
Na coluna Estatísticas de segurança, clique em Ver.
É apresentado o painel Estatísticas de segurança para a compilação:
Este painel apresenta as seguintes informações:
Nível SLSA: esta compilação alcançou o nível 3 da SLSA. Clique no link Saiba mais para saber o que significa este nível de segurança.
Vulnerabilidades: quaisquer vulnerabilidades encontradas nos seus artefactos. Clique no nome da imagem (java-guestbook-backend) para ver os artefactos que foram
analisados quanto a vulnerabilidades.
Dependências da imagem de contentor criada no Artifact Registry.
Detalhes da compilação: detalhes da compilação, como o criador e o link para ver os registos.
Limpar
Para evitar incorrer em custos na sua Google Cloud conta pelos
recursos usados nesta página, elimine o Google Cloud projeto com os
recursos.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-19 UTC."],[],[],null,["# Quickstart: Build applications and view security insights\n\nBuild an application and view security insights\n===============================================\n\nThis quickstart explains how to build an application and view security insights\nfor the build in the **Security insights** panel in the Google Cloud console.\n\nYou will:\n\n- Build and containerize a Java application using Cloud Build and push the container image to Artifact Registry Docker repository.\n- View the following security insights for the build:\n\n - **[Supply-chain Levels for Software Artifacts (SLSA)\n level](https://slsa.dev/spec/v0.1/levels)**, which identifies the maturity level of your software build process in accordance with the SLSA specification .\n - **Vulnerabilities** in build artifacts.\n - **Software bill of materials (SBOM)** for the build artifacts.\n - **Build provenance**, which is a collection of verifiable metadata about a build. It includes details such as the digests of the built images, the input source locations, the build toolchain, build steps, and the build duration.\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n- [Create or select a Google Cloud project](https://cloud.google.com/resource-manager/docs/creating-managing-projects).\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n - Create a Google Cloud project:\n\n ```\n gcloud projects create PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with a name for the Google Cloud project you are creating.\n - Select the Google Cloud project that you created:\n\n ```\n gcloud config set project PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your Google Cloud project name.\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud Build, Artifact Registry, and Container Scanning APIs:\n\n\n ```bash\n gcloud services enable cloudbuild.googleapis.com artifactregistry.googleapis.com containerscanning.googleapis.com\n ```\n\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n- [Create or select a Google Cloud project](https://cloud.google.com/resource-manager/docs/creating-managing-projects).\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n - Create a Google Cloud project:\n\n ```\n gcloud projects create PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with a name for the Google Cloud project you are creating.\n - Select the Google Cloud project that you created:\n\n ```\n gcloud config set project PROJECT_ID\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your Google Cloud project name.\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud Build, Artifact Registry, and Container Scanning APIs:\n\n\n ```bash\n gcloud services enable cloudbuild.googleapis.com artifactregistry.googleapis.com containerscanning.googleapis.com\n ```\n\n\u003cbr /\u003e\n\nPrepare your environment\n------------------------\n\n1. Set your project ID as an environment variable:\n\n export PROJECT_ID=$(gcloud config get project)\n\n2. Clone the repository that contains the Java code sample to build and\n containerize:\n\n git clone https://github.com/googlecloudplatform/software-delivery-shield-demo-java.git\n cd software-delivery-shield-demo-java/backend\n\nCreate the Artifact Registry repository for your image\n------------------------------------------------------\n\n1. Create a new Docker repository named `containers` in the location\n `us-central1` with the description \"Docker repository\":\n\n gcloud artifacts repositories create containers \\\n --repository-format=docker \\\n --location=us-central1 --description=\"Docker repository\"\n\n2. Verify that your repository was created:\n\n gcloud artifacts repositories list\n\n You should see `containers` in the list of displayed repositories.\n\nBuild the application\n---------------------\n\nBuild and containerize the Java application using Cloud Build.\nThe following command builds and containerizes the Java application and\nstores the built container in the Artifact Registry docker repository: \n\n gcloud builds submit --config=cloudbuild.yaml --region=us-central1\n\nAfter the build completes, you see a success status message similar to the\nfollowing: \n\n \u003cpre class=\"none lang-sh\"\u003e\n DONE\n -----------------------------------------------------------------------------\n ID: 3e08565f-7f57-4449-bc68-51c46cf33d03\n CREATE_TIME: 2022-09-19T15:41:07+00:00\n DURATION: 54S\n SOURCE: gs://sds-docs-project_cloudbuild/source/1663602066.777581-6ebe4b2d6fd741ffa18936d7f78055e9.tgz\n IMAGES: us-central1-docker.pkg.dev/sds-docs-project/containers/java-guestbook-backend:quickstart\n STATUS: SUCCESS\n \u003c/pre\u003e\n\nGenerate an SBOM for the built image\n------------------------------------\n\nAn SBOM is a full inventory of an application, identifying the packages\nyour software relies on. The contents can include third-party software from\nvendors, internal artifacts, and open source libraries.\n\nGenerate the SBOM for the image you built in the previous section: \n\n gcloud artifacts sbom export \\\n --uri=us-central1-docker.pkg.dev/${PROJECT_ID}/containers/java-guestbook-backend:quickstart\n\nView security insights\n----------------------\n\nThe Cloud Build UI in the Google Cloud console contains the\n**Security insights** panel that displays security information related to the\nbuild such as SLSA level, any vulnerabilities in the dependencies, and build\nprovenance.\n\nTo view the **Security insights** panel:\n\n1. Open the **Build history** page in the Google Cloud console:\n\n [Open the Build history page](https://console.cloud.google.com/cloud-build)\n2. Select your project and click **Open**.\n\n3. In the **Region** drop-down menu, select **us-central1**.\n\n4. In the table with the builds, locate the row with the build you just\n executed.\n\n5. Under the **Security insights** column click **View**.\n\nYou see the **Security insights** panel for the build:\n\nThis panel displays the following information:\n\n- **SLSA Level:** This build has achieved SLSA Level 3. Click the **Learn\n more** link to learn what this security level means.\n\n- **Vulnerabilities:** Any vulnerabilities found in your artifacts. Click the\n image name (**java-guestbook-backend**) to see the artifacts that have been\n scanned for vulnerabilities.\n\n- **Dependencies** for the built container image in Artifact Registry.\n\n- **Build details:** Details of the build such as the builder and the link to\n view logs.\n\nClean up\n--------\n\n\nTo avoid incurring charges to your Google Cloud account for\nthe resources used on this page, delete the Google Cloud project with the\nresources.\n\n1. Disable Container Scanning API:\n\n gcloud services disable containerscanning.googleapis.com --force\n\n2. Delete the Artifact Registry repository:\n\n gcloud artifacts repositories delete containers \\\n --location=us-central1 --async\n\n You have now deleted the repository that you created as part of this\n quickstart.\n\nWhat's next\n-----------\n\n- Learn more about the [security insights panel in\n Cloud Build](/build/docs/view-build-security-insights)\n- Learn how to [view security insights when deploying to Cloud Run](/software-supply-chain-security/docs/quickstarts/deploy-run-view-security-insights)\n- Learn how to [view security insights when deploying to GKE](/software-supply-chain-security/docs/quickstarts/deploy-gke-view-security-insights)\n- Learn more about [software supply chain security](/software-supply-chain-security/docs/overview)"]]
