A cikin rubutunmu na baya game da CI/CD Pipelines, mun gani yadda ake yin hack a CI/CD yanayin da mai yiwuwa an kare shi.
Bari mu tuna da batunmu a cikin rubutun da ya gabata: mun fara da wasu pipeline wanda hakan ya kasance mai rauni ga Guba kai tsaye Pipeline kisa (I-PPE) kuma, don gyara shi, mun yanke shawarar raba shi pipeline zuwa kashi biyu:
- Na farko pipeline (Gina CI), wanda aka tabbatar yana da aminci ga D-PPE da I-PPE, zai duba lambar PR, ya yi ginin, sannan ya samar da wani kayan tarihi.
- Na biyu pipeline (Gwaji CI), wanda kuma yana da aminci ga D-PPE da I-PPE za su duba lambar Tushe (don guje wa gyaran rubutun harsashi) kuma su aiwatar da rubutun asali akan kayan tarihi.
- Don daidaita gwajin CI pipeline don gudanar da BAYAN Gina CI pipeline, mun yi amfani gudanar da aiki jawo.
Mun sanya wa wannan suna a matsayin Yanayi na 3.
Ko da yake, kamar yadda muka ambata a cikin wannan rubutun, akwai wasu mafita, mun yanke shawarar aiwatar da wannan "mafita" don dalilai na ilmantarwa, don mu iya zurfafa cikin raunin da ke tattare da CI/CD pipelines.
Bayan haka, mun ga yadda ake yin kutse a wannan yanayin ta hanyar guba kayan tarihiWannan shine abin da muke kira Guba ta Kayan Tarihi, watau ikon gyara (hack) pipeline dabaru ta hanyar canza wani pipeline kayan gargajiya.
Mene ne matsalar wannan hanyar? Mun ga cewa matsalar tana tasowa ne lokacin da kowane mai amfani ya "ƙirƙira" sabon tsari. pipeline.
Idan mai amfani ya buɗe PR wanda ke ɗauke da sabon pipeline, GitHub zai aiwatar da hakan pipeline (idan aka yi la'akari da wasu sharuɗɗa, kamar yadda muka gani a cikin rubutun).
Mai amfani zai iya ƙirƙirar sabon shafi pipeline da suna iri ɗaya da Build CI!! Haka ne, abin mamaki ne, amma GitHub yana ba ku damar ƙirƙirar biyu pipelines da suna iri ɗaya!!
Lokacin da mai amfani ya buɗe PR tare da waɗannan canje-canje, "sabon" pipeline za a kashe shi (loda wani kayan tarihi mai guba) da kuma Shirin CI pipeline za a kashe shi bayan haka, wanda zai haifar da rubutun harsashi "wanda aka gyara" wanda aka sake rubuta rubutun harsashi "na asali" da ke cikin pipeline wurin aiki. Don haka, wannan "mafita" ba ta guje wa raunin I-PPE ba (kamar yadda za mu iya gani a ƙasa)
Wadanne matsaloli ne? Aƙalla, akwai wasu matsaloli:
- Na farko, Ta yaya za a tabbatar da cewa ba a yi amfani da tsarin ginawa ba? A wannan yanayin, mai amfani da mugunta ya sami damar canza tsarin ginawa da aka yi niyya ta amfani da su pipeline don ƙirƙirar wani abu mai guba.
- Abu na biyu, ta yaya za mu iya tantance asalin wani kayan tarihi?
Waɗannan tambayoyin suna jefa mu cikin hannun Shaidar Software yanki!!
Shaidar Software
An shaida wani ɓangare ne na data wakilta shaidar wani lamariA duniyar gaske, galibi muna kiran waɗannan takaddun shaida.
Misali, idan dakin gwaje-gwaje ya gwada jininka, ana yin rikodin bayanai game da gwajin kuma an tabbatar da su. Sakamakon gwajin jinin an yi shi ne da verifiable da kuma wanda aka gano.
Kusa da yankin IT ɗinmu, za ku iya tsammanin abin da zai zama fassarar wannan tsari zuwa, misali, tsarin tattarawa.
Bayani game da yanayin uwar garken tattarawa da kayan aiki, kayan (lambar tushe), da kayayyaki/kayayyakin tarihi (lambar binary) za su kasance wani ɓangare na irin wannan shaidar.
Babu shakka, dole ne a samar da shaidar ta hanyar mai bayar da shaida mai izini (wanda aka tabbatar kuma wanda ba za a iya musantawa ba) don samar da sahihanci.
Wataƙila, wasu daga cikinku na iya tunani .. kuma menene bambanci tsakanin sa hannu da kuma takardun shaida?
Sa hannun Code da Shaida
A babban mataki, a sa hannu Ana ƙirƙirar ta amfani da maɓallan maɓalli da kayan tarihi. Maɓallan maɓalli sun ƙunshi maɓallan jama'a da maɓallan sirri.
Mai amfani zai sanya hannu kan wani abu ta amfani da maɓallin sirri, wasu kuma za su iya tabbatar da sa hannun ta amfani da maɓallin jama'a. Dole ne a ɓoye maɓallin sirri, amma maɓallin jama'a yana yaɗuwa sosai.
Ana iya amfani da sa hannu don tabbatar da cewa mai riƙe da maɓallin sirri ya yi amfani da maɓallin sirri don sanya hannu kan kayan tarihi.
Sa hannu kar a tabbatar
- Mai amfani nufi don sanya hannu kan kayan tarihi (watakila an yaudare su), ko
- Manufar mai amfani ta yin duk wani abu takamaiman da'awa game da kayan tarihi
tare da Gasawa, maimakon sanya hannu kai tsaye kan wani abu na tarihi, masu amfani suna ƙirƙirar wani nau'in Daftarin aiki cewa yana kama niyyarsu bayan sanya hannu kan kayan tarihi da duk wani abu da ya shafi hakan takamaiman da'awa ana yin sa a matsayin wani ɓangare na wannan sa hannu.
Tsarin Shaidar In-toto
Tsarin da aka fi amfani da shi shine tsarin Tsarin Shaidawa na cikin-toto
- ya bayyana a standard tsarin tabbatarwa wanda ke haɗa batutuwa, kayan tarihi da ake bayyanawa, zuwa ingantattun bayanai game da kayan tarihi
- yana samar da saitin an riga an ayyana annabci don isar da ingantattun bayanai a ko'ina cikin kuma a cikin sarkar samar da software
Bari mu yi bayani dalla-dalla game da tsarin tabbatarwa.
An Gwadawa ne mai Takardar da aka sanya hannu ta hanyar dijital wancan ya kunshi Kalamai.
The Sirri shine tsakiyar layin shaidar, yana ɗaure shi zuwa wani takamaiman subject kuma ba tare da wata shakka ba gano nau'ikan Tsinkaya:
- subject: a nassoshi masu aminci ga kayan tarihi na sirri (yawanci ta hanyar hash), kuma
- An yi annabci: wani tsari na musamman ikirarin game da wannan kayan tarihi ana kiransa da Bayani. Ana iya amfani da waɗannan da'awar don bayyana (da kuma tabbatar da) duk abin da za ku iya tunani a kai! Suna iya wakiltar amincewa da hannu, asalin kayan tarihi, sakamakon gwaji ta atomatik, hanyar binciken kuɗi, ko ƙari!
Idan aka sanya hannu kan wannan Bayanin ta hanyar ɓoye sirri, to ana kiransa da Gwadawa
Ta wannan hanyar, a matsayin misali, Alice ta ƙirƙiri Bayani game da wani abu na tarihi kuma ta sanya hannu a kai ta amfani da maɓallin sirrinta, tana ƙirƙirar Shaida.
- Bob zai iya sannan tabbatar da sa hannun a cikin wannan Takardar Shaida, ya ba shi damar amincewa da da'awar ciki.
Bob zai iya amfani da waɗannan da'awar don yanke shawara ko a yarda a yi amfani da wannan kayan tarihi ko a'a.
Shin Shaidawa za su iya taimakawa wajen magance Gubar Kayan Aiki?
Bayan wannan gabatarwar ga Attestations, bari mu koma ga matsalarmu. Ta yaya shaidu za su iya taimaka mana wajen magance matsalarmu, wato mu guji gubar kayan tarihi?
Mai amfani da miyagun ƙwayoyi ya sami damar ƙirƙirar wani abu da ya wuce tsarin "na hukuma", wato ta hanyar amfani da shi/ita pipeline don samar da kayan tarihi.
Zai yi kyau idan muka tabbatar da cewa an gina kayayyakin da ake saukewa tare da jami'in. pipelines. Wannan misali ɗaya ne kawai na abin da za mu iya kira "Matsalolin Tampering", amma akwai wasu da yawa.
Kamar yadda kuke gani a hoton da ke sama, wuraren da ake yin kutse suna da yawa. Ta wannan hanyar, mai amfani pipeline (Gwajin CI a misalinmu) dole ne ya kimanta sahihancin tsarin ginin Da kuma mutuncin kayan tarihi da kanta.
A cikin misalinmu, an ƙirƙiri kayan tarihi mai guba ta hanyar gabatar da sabon abu (mai guba) pipeline wanda ke kawo cikas ga tsarin ginawa. Amma mai amfani da mugunta zai iya:
- canza lambar bayan an cire ta daga wayar SCM don ƙirƙirar binary mai cutarwa
- maye gurbin binary na dama da aka samar ta hanyar tattarawa da duk wani binary mara kyau
- lalata Rijistar Kayan Tarihi da kuma loda wani kayan tarihi mai guba da aka gina ta kowace hanya
- da dai sauransu.
Kamar yadda kake gani, akwai wasu "masu tayar da hankali" da za a iya gyarawa.
Me yake da muhimmanci a nan? Babu shakka don kare duk waɗannan wuraren "masu tangarɗa". Amma, a ƙarshe, abin da ya fi muhimmanci shi ne cewa "mai amfani" na kayan tarihi zai iya tantance sahihancin kayan tarihi, kuma ya yanke shawara ko zai ci gaba da shi ko a'a.
Za mu iya tantance sahihancin wani abu ta hanyoyi biyu.
Ɗaya shine ta hanyar kimantawa tabbatarwa na kayan tarihi.
Ta hanyar samar da Shaidar Asalin, muna samar da bayanai masu amfani (wanda aka tabbatar da shi yadda ya kamata kuma wanda ba a ƙi ba) game da kayan tarihi. A cikin misalai masu zuwa, za mu yi amfani da GISHIRIN GISHI (Layin Shaidar Software don Amincewa), bangaren da ake amfani da shi wajen samarwa, yin rijista, da kuma tabbatar da shaidar software.
- name: Building ...
run: |
# mvn will compile and create target/MyApp.war
mvn clean package
- name: Generating provenance
run: |
#!/usr/bin/env bash
shopt -s expand_aliases
alias salt=$PWD/salt_pro/xygeni_salt/salt
echo " "
echo "-----------"
echo "Generating Provenance with CLI ..."
salt at slsa \
--basedir ${GITHUB_WORKSPACE}/target \
--key="${PRIVATE_KEY}" \
--public-key=${GITHUB_WORKSPACE}/Test1_public.pem \
--key-password=${KEY_PASSWD} \
--output-unsigned=${GITHUB_WORKSPACE}/cli_provenance_${PIPELINE}_unsigned.json \
--pipeline ${PIPELINE} --pretty-print \
--file ./MyApp.war
A cikin lambar da ke sama, za ku iya ganin akwai mataki da ke gina fayil ɗin yaƙi da kuma mataki na biyu da ke samar da shi Shaidar AsalinDomin yin hakan, pipeline yana amfani da maɓallin sirri kuma yana haɗa da maɓallin jama'a a cikin shaidar.
A bayan fage, Xygeni's gishiri umarni yana adana shaidar a cikin wani ledger (wanda aka fi sani da rajistar shaida, Rikodi a yanayinmu amma zaka iya amfani da duk wani). Da zarar an yi haka, abokin ciniki pipeline zai iya haɗawa da Xygeni's Injin Tabbatarwa don tabbatar da asalin kayan tarihi da kuma tantance sahihancin kayan tarihi.
- name: 'Verifying the attestation'
run: |
#!/usr/bin/bash
echo " "
echo "-------"
# Calculate sha256sum for the artifact
SHA_SUM=$(sha256sum ./MyApp.war | cut -f1 -d ' ')
# Recover the attestation Id from the sha256sum
ATT_ID=$(echo $(salt -q registry search --digest sha256:$SHA_SUM --format json) | jq -r .[-1].gitoidSha256)
echo " "
echo "-------"
# Download the provenance attestation
echo "Downloading the provenance attestation ..."
salt -q reg get --id=$ATT_ID --format=json > ${GITHUB_WORKSPACE}/provenance_kk.signed.json
echo " "
echo "-------"
echo "Verifying provenance ..."
salt verify \
--basedir ${GITHUB_WORKSPACE} \
--attestation=${GITHUB_WORKSPACE}/provenance_kk.signed.json \
--public-key=${GITHUB_WORKSPACE}/Test1_public.pem \
--file ./MyApp.war
Tsarin tabbatarwa yana kimantawa:
- The kayan tarihi sha256sum yana da inganci (watau akwai shaida game da wannan "batun"), kuma
- The tabbacin ya tabbata daidai (an samar da shi ta hanyar amfani da maɓalli mai zaman kansa mai dacewa)
Wannan tsarin tabbatarwa zai iya tantance cewa duka kayan tarihi da kuma shaidar suna da inganci.
Amma, kamar yadda kuka tuna, a yanayinmu, an ƙirƙiri kayan tarihi ta hanyar "mugunta" pipeline (watau ba na asali ba ne ta hanyar gyara pipeline) To, dole ne mu ci gaba da duba wani fanni: cewa an ƙirƙira kayan tarihi ta hanyar "asali" pipeline, ba wani ba.
Don yin hakan, kawai haɗa da layi mai sauƙi don duba wannan yanayin, misali:
echo " "
echo "-------"
# Download the provenance attestation
echo "Downloading the provenance attestation ..."
salt -q reg get --id=$ATT_ID --format=json > ${GITHUB_WORKSPACE}/provenance_kk.signed.json
WFR=$(jq -r .payload ${GITHUB_WORKSPACE}/provenance_kk.signed.json |base64 -d | jq -r .predicate.buildDefinition.internalParameters.environment.GITHUB_WORKFLOW_REF)
echo $WFR | grep cicd_top10_3_salt\/.github\/workflows\/build.yml
Wannan ƙarin binciken ba zai yi nasara ba idan ba a samar da kayan tarihin ta hanyar "amintaccen" mu ba. pipeline.
Idan asalinmu ne ya samar da kayan tarihi pipeline (cicd_top10_3_salt/.github/workflows/build.yml), umarnin grep zai yi nasara, in ba haka ba, zai gaza, yana karya umarnin. pipeline da kuma dakatar da duk wani ƙarin matakai.
"Mai gini" pipeline kawai wurin yin kuskure ne da za a duba amma, kamar yadda aka ambata a baya, akwai wasu wuraren yin kuskure da ya kamata mu duba.
Misali, Me zai faru idan an yi amfani da lambar tushe bayan an biya kuɗin repo kuma kafin umarnin ginawa? A wannan yanayin, lambar da za a gina ba iri ɗaya ba ce da aka adana a cikin SCM.
Duba wannan wurin da aka yi wa kutse abu ne mai sauƙi ta yadda za a iya duba hashes na kayan a kowane mataki.
SHA_ATT_MATERIAL=$(jq -r .payload ${GITHUB_WORKSPACE}/provenance_kk.signed.json | base64 -d | jq -r .predicate.attestations[0].predicate.materials[].digest[])
SHA_STEP_MATERIAL=$(jq -r .payload ${GITHUB_WORKSPACE}/provenance_kk.signed.json | base64 -d | jq -r .predicate.attestations[3].predicate.materials[0].digest[])
karshe
A taƙaice, a Shaidar Software wata magana ce da aka yi game da wani ɓangare na manhaja, wato wata sanarwa da aka tabbatar (metadata) game da wani kayan aikin software ko tarin kayan aikin software.
Shaidar software gabaɗaya ce ta kayan tarihi/sa hannun lamba. Shaidar takarda ce da aka sanya wa hannu (a cikin wani tsari, wanda yawanci ya dogara da JSON) wanda ke haɗa bayanai da kayan tarihi. Suna wakiltar shaidun da ke haɗa bayanai (kayayyaki) da fitarwa (kayayyakin tarihi da aka samar) a kowane matakin gini.
Shaidar tana ba da rikodin da za a iya tabbatarwa game da matakan da aka ɗauka don gina kayan aikin software na ƙarshe, gami da kayan shigarwa don kowane mataki da umarnin ginawa da ke gudana.
A ƙarshe, Shaidar Software hanya ce mai kyau don duba fannoni daban-daban na ingancin tsarin gininmu.
Ka gama jerin shirye-shiryen? Kada ka damu! Ji daɗin komawa zuwa 'Guba Pipeline Aiwatarwa (PPE)'ko kuma duk wani rubutu da ya sake tayar da sha'awarka!
Ku kasance tare da mu, za mu yi zurfin bincike kan takaddun shaida na software da kuma build security a cikin ƙarin rubuce-rubucen blog.
