cybergabisoft/depalertDepAlert is an open-source security gate for your CI/CD pipeline. It analyzes SBOMs against malware intelligence data and quickly tells you whether your build includes known malicious packages.
This tool is part of the CTWall platform. See: CTWall
DepAlert is an open-source security gate for your CI/CD pipeline. It analyzes SBOMs against malware intelligence data and quickly tells you whether your build includes known malicious packages.
DepAlert solves core software supply-chain problems that directly impact release speed, risk, and cost:
MALWARE, CLEAN, UNKNOWN) in every pipeline run.fail-on) and auditable exception workflow.See 00_quick_start.md for step-by-step instructions.
depalert is a CI/CD CLI that:
POST /api/v1/ingest)GET /api/v1/tests/{testId}/revisions/{revisionId}/depalert-verdict)The tool is project-scoped. You can select the target project by:
project-id (UUID), orproject-name (resolved through API).If both are provided, project-id takes precedence.
DepAlert returns one revision results:
CLEAN - no malware finding detected - exit 0MALWARE - at least one malware finding was detected in the revision - exit 1UNKNOWN - analysis is not complete yet - exit 2 (or exit 0 with fail-on=NONE)CLI output format:
VERDICT: <MALWARE|CLEAN|UNKNOWN> (malware=<n> clean=<n> unknown=<n> total=<n>, elapsed=<t>)
JSON mode is available via --format json (or CTWALL_OUTPUT=json).
Example JSON output:
{
"version": "1.1.0",
"status": "success",
"exitCode": 0,
"projectId": "28e241e3-b924-4e1a-abc2-d592e8dd811c",
"testId": "13271a70-cf47-4f3b-9e33-cb41ed0c793e",
"revisionId": "c4d1f1a4-c018-488e-9dd0-6cfdbed83bf3",
"verdict": "CLEAN",
"malwareComponents": 0,
"cleanComponents": 12,
"unknownComponents": 0,
"totalComponents": 12,
"elapsedMs": 1842,
"timedOut": false,
"failOn": "MALWARE",
"message": "depalert completed"
}
VERDICT: <MALWARE|CLEAN|UNKNOWN> (malware=<n> clean=<n> unknown=<n> total=<n>, elapsed=<t>)
0 = pass1 = policy fail or runtime error2 = final verdict is UNKNOWN and fail-on is not NONE| Flag | ENV | Required | Default | Description |
|---|---|---|---|---|
--url | CTWALL_API_URL | yes | http://localhost:8080 | CTWall API URL |
--key | CTWALL_API_KEY | no | empty | API token (Authorization: Bearer ...) |
--project-id | CTWALL_PROJECT_ID | conditional | none | Target project UUID (has priority over project-name) |
--project-name | CTWALL_PROJECT_NAME | conditional | none | Target project name (resolved to UUID through API) |
--file | CTWALL_SBOM_FILE (or legacy SBOM_FILE) | yes | none | SBOM file path |
--product | CTWALL_PRODUCT | yes | none | Product name |
--scope | CTWALL_SCOPE | yes | none | Scope name |
--test | CTWALL_TEST | yes | none | Test name |
--fail-on | CTWALL_FAIL_ON | no | MALWARE | CSV verdict list: MALWARE,CLEAN,UNKNOWN or NONE |
--ignore-file | CTWALL_IGNORE_FILE | no | depalert.ignore | Optional YAML exceptions file for local verdict override + triage updates |
--format | CTWALL_OUTPUT | no | text | Output format: text or json |
project-id or project-name is required.project-name is resolved using GET /api/v1/projects.https is required for non-local hosts.--allow-insecure, orCTWALL_ALLOW_INSECURE=true.--skip-tls-verify, orCTWALL_SKIP_TLS_VERIFY=true.Please see
DepAlert is licensed under the BSD 3-Clause License
--timeout-seconds |
CTWALL_WAIT_TIMEOUT_SECONDS |
| no |
180 |
| Sync wait timeout in seconds |
--allow-insecure | CTWALL_ALLOW_INSECURE | no | false | Allow HTTP for non-local hosts |
--skip-tls-verify | CTWALL_SKIP_TLS_VERIFY | no | false | Skip TLS certificate verification for HTTPS (unsafe, test only) |