Software Composition: Why, What, and How

Is your organization serious about the security of third-party dependencies? Do you get questions from your CISO/SecOps team about open-source health? Does the complexity of your application landscape make it difficult to understand which modules, widgets, java libraries are used where? Then, keep reading!

Mendix is proud to announce Software Composition, a newly released capability that provides an accurate inventory of application and application landscape component dependencies. Software Composition is a fundamental building block to improve your security posture.

Anatomy of a Mendix Application

Let’s start with the basics. A Mendix maker creates pages, domain models, microflows, nanoflows, custom modules and more to build a Mendix app. This is called the Mendix Model. The Mendix Model can be extended with custom java and java script if needed. All these are built by the application maker and are marked in black color in the illustration below.

When custom Java or JavaScript is used to extend the Mendix Model, Java libraries and npm packages can be added to the Mendix application. Pre-built, re-usable components such as modules and widgets from the Mendix Marketplace can also be used to super-charge your application. Lastly, the right Mendix Runtime version will help run the application. All these are third-party dependencies are illustrated in blue color below. These third-party dependencies can be maintained by Mendix, its community or its partners.

Challenge

Over time, third-party dependencies may become deprecated, outdated, vulnerable or unpreferred, depending on your enterprise quality and security rules. Hence, visibility into these third-party dependencies is key to effectively managing the quality and security of your application landscape.

This need becomes more pronounced as the number of applications in the landscape increases. A central place to view application landscape components becomes vital to manage landscape security risk.

Introducing Software Composition

To enable this visibility, Mendix will generate a software bill of materials (SBOM). An SBOM is a .json file created in the Cyclone DX format that summarizes the third-party dependencies used in software. The SBOM will consist of standard marketplace modules, widgets, java libraries, npm libraries and runtime version, depending on the supporting Studio Pro version. SBOMs can be generated using MxBuild.

Mendix will automatically generate SBOMs under the hood for new deployment packages with Studio Pro versions 9.24.22 and above, 10.6.9 and above, and 10.10.0 and above for free cloud, public cloud and cloud-dedicated deployment models and make these available for download.

But don’t worry, you don’t need to parse .json files to get visibility. You can easily view the SBOM contents on the Software Composition page in Control Center and Developer Portal in an easy-to-consume manner. In Control Center, software composition visibility is across the entire application landscape. In Developer Portal, visibility is for each application.

On the Software Composition page in Control Center, you can do the following:

1. View the Software Composition of each application environment
2. Download the SBOM or export via excel
3. View a list of all unique components used in your application landscape. For each component, it’s also possible to view the number of applications and environments using it.