Technology · Ebook

Ortelius: A Supply-Chain Evidence Catalog for Microservices

by Shriira Press

Ortelius is an open-source supply-chain evidence catalog maintained by the Continuous Delivery Foundation, built for the question microservices made hard: what version of what is running where, with what vulnerabilities? This book starts with the way decomposition scatters evidence across pipelines, registries, and clusters, then builds up the evidence-catalog idea that answers it. You will learn the data model of components, applications, endpoints, and domains; how Ortelius aggregates per-component SBOMs into a complete application bill of materials; how it derives application versions automatically as their parts change; how its digital twin maps releases to running deployments and continuously correlates them against OSV.dev; and how the CLI feeds it from a CI/CD pipeline. A closing chapter covers adopting it well and where it fits among neighboring tools.

Contents

1. 1Preface
2. 2Chapter 1 — The Microservices Evidence Problem
3. 3Chapter 2 — What Ortelius Is
4. 4Chapter 3 — The Data Model: Components, Applications, and Endpoints
5. 5Chapter 4 — Aggregating SBOMs
6. 6Chapter 5 — Versioning Applications Made of Microservices
7. 7Chapter 6 — The Digital Twin and Continuous CVE Correlation
8. 8Chapter 7 — Feeding Ortelius from the Pipeline
9. 9Chapter 8 — Ortelius in Practice