Okwu Mmalite
Na Ọgọst 22, 2025, Ụlọ Ọrụ Nchekwa Nchekwa Kọmputa na Akụrụngwa (CISA) bipụtara akwụkwọ nke 2025 Minimum Elements for a Software Bill of Materials (SBOMMmelite a dabere na usoro NTIA nke 2021 ma gosipụta oke ya SBOM standards etoola. Maka ndị mmepe na ndị otu nchekwa, ọ bụ oge mgbanwe. Karịsịa ihe niile, ihe ọhụrụ CISA SBOM mgbanwe nduzi SBOMsite na ndepụta ihe ndị na-anaghị agbanwe agbanwe ruo na ngwaọrụ bara uru nke na-eme ka njikwa ihe egwu ngwanrọ sie ike ma na-echebe usoro ọkọnọ ngwanrọ.
Edemede gọọmentị dị na CISA SBOM peeji nke ihe onwunwe enwere ike ibudata ya ozugbo dị ka PDF.
CISA SBOM vs. NTIA 2021: Ihe kpatara mmelite ahụ ji dị mkpa
The mbụ NTIA SBOM Ihe kacha nta (2021) kere ntọala maka nghọta doro anya. N'oge ahụ, nnabata nwere oke ma ngwa ọrụ ahụ etobeghị nke ọmaGaa n'ihu ngwa ngwa, SBOMụlọ ọrụ na-atụ anya ugbu a enterprises, ya na CI/CD njikọta na akpaaka na-aghọ ihe a na-ahụkarị.
The CISA SBOM Ihe Ndị Dị Mkpirisi 2025 na-egosi mgbanwe a. N'ezie, ha na-ebuli ihe mgbochi maka SBOM standardsite n'ịchọ data bara ụba, akpaaka karịa, na nghọta ndị a pụrụ ime nke otu nwere ike iji maka njikwa ihe egwu ngwanrọ na-aga n'ihu.
Ihe dị ọhụụ na CISA SBOM Ihe kacha nta 2025
| mmewere | NTIA 2021 | CISA SBOM 2025 | Mmetụta Bara Uru Maka Ndị Otu |
|---|---|---|---|
| Hash nke akụkụ | Akọwaghị | Agbakwunyere (nguzozi nzuzo) | Nyochaa ihe ochie ma chọpụta ihe na-emebi ihe; ya mere, mee ka a mara na e nwere nkwenye checksum/mbinye aka na CI/CD. |
| License | Akọwaghị | Agbakwunyere (ihe egwu iwu na nkwado) | Mee ka nnabata ikike OSS rụọ ọrụ na-akpaghị aka; Ọzọkwa, gbochie ikike ndị na-adabaghị na PR ma ọ bụ oge nrụpụta. |
| Aha Ngwaọrụ | Akọwaghị | Agbakwunyere (nghọta nke jenereta) | Chọpụta SBOM mmalite; n'ihi ya, standardize SBOM ngwaọrụ jenereta kwa pipeline. |
| Ọdịnaya Ọgbọ | Akọwaghị | Agbakwunyere (tupu iwu / oge iwu / mgbe iwuchara) | Họrọ ogbo kwesịrị ekwesị maka SBOM ihe e kere eke. Dịka ọmụmaatụ, oge nrụpụta SBOMs na-eme ka mmepụtagharị dịkwuo mma, mgbe e wuchara ya SBOMs ijide ihe ndị e ji mee ihe maka nchekwa ọrụ. |
| Onye Mmepụta Ngwanrọ | "Aha Onye Na-eweta Ihe" | Agbanwegharịrị aha ma mee ka ọ doo anya | Belata mgbagwoju anya n'ihe gbasara onye nwe ya; iji mee ka o doo anya, maapụ onye nrụpụta na ụlọ ọrụ iwu gị na SBOM metadata. |
| Uche | "Imi" (nke pere mpe) | Mkpuchi zuru oke (kpọmkwem + nke na-agafe agafe) | Hụ na eserese ndabere zuru oke; ya mere, tinye ihe ndị na-agbanwe agbanwe site na faịlụ mkpọchi na ihe ngosi. |
| Amaghị ama | Njikwa vague | Nkọwapụta (anaghị efu ma ewepụ ya) | Kanye akara oghere ndị ahụ n'ụzọ doro anya; tinyekwara, meghee ihe ndị na-esochi iji dozie data akụkụ ndị na-efu. |
Ihe mere mmelite ndị a ji dị mkpa maka njikwa ihe egwu ngwanrọ
The ọhụrụ SBOM Ihe kacha nta n'aka SBOMs n'ime ngwaọrụ ihe egwu bara uru., ha dabara kpọmkwem n'ime oge a njikwa ihe egwu ngwanrọ site n'inyere òtù aka:
- Jiri hash nyochaa iguzosi ike n'ezi ihe iji hụ na ihe na-emebi ihe adịghị njọ.
- Chọta ihe adịghị ike ngwa ngwa site na ijikọ SBOMs na ndụmọdụ VEX na CSAF.
- Mee nyocha ikike akpaaka iji belata ihe egwu iwu.
- Idozi anya na ihe ndị a na-eji eme ihe n'ezie.
- update SBOMs maka mwepụta ọ bụla na mgbe ọ bụla nkọwa ọhụrụ pụtara.
- Share SBOMọ dị mfe site na API, ebe nchekwa, ma ọ bụ URL ndị e mepụtara iji gbasaa na DevOps.
N'ihi ya, SBOMs na-aghọ akwụkwọ ndụ nke na-akwado nchebe na-aga n'ihu. N'ikpeazụ, ụdị a dabara na iwu ndị dị mkpa dịka EO 14028 (US), ntuziaka NIST, Atụmatụ Nchekwa Ịntanetị nke EU, ntuziaka FDA, na CMMC.
Na-erube isi CISA SBOM nduzi na DevOps pipelines
Iji soro ihe ọhụrụ ahụ CISA SBOM Ihe kacha nta, òtù dị iche iche kwesịrị ịgbanwe ma usoro na ngwaọrụ:
- machiini SBOM mmepụta maka ntọhapụ ọ bụla na CI/CD.
- Kpuchie ma ndị na-adabere kpọmkwem na ndị na-apụtaghị ìhè.
- Flag Amaghị ama n'ụzọ doro anya.
- Ntughari SBOMmgbe ozi ọhụrụ pụtara.
- Share SBOMsite na API, ebe nchekwa, ma ọ bụ URL.
- Gosipụta eziokwu site na iji mbinye aka SPDX na CycloneDX SBOM standards.
Ya mere, nrubeisi pụtara iwulite SBOM n'ime usoro ọrụ mmepe kama itinye ya na njedebe. Ọzọkwa, nke a na-eme ka ndị mmepe, ndị otu nchekwa, na ndị njikwa nnabata niile nwee otu echiche a pụrụ ịtụkwasị obi gbasara ihe egwu ngwanrọ.
Otu Xygeni si enyere ndị otu aka izute ma gafere oke CISA SBOM standards
Xygeni na-eme ka iwu kwadoro CISA SBOM Ihe kacha nta enweghị nsogbu ma gbasaa uru ha site na ikike nchekwa miri emi:
- CI/CD nhazi: machiini SBOM mmepụta na SPDX na CycloneDX maka ọ bụla pipeline.
- Nkwalite: Tinye hashes, ikike, na metadata ngwaọrụ maka ịhụ ihe niile.
- Akụkọ Mkpughe Ndabere (VDR): njikọ SBOM data nwere adịghị ike dị ndụ, mmetụta, na atụmatụ ndozi.
- Ibu ụzọ: Jikọta nyocha iru eru na Akara EPSS ilekwasị anya n'adịghị ike ndị a ga-eji mee ihe.
- Sistemụ ịdọ aka ná ntị mbụ: Chọpụta ngwugwu ndị a na-enyo enyo na ndekọ tupu ha emetụta ihe owuwu ahụ.
- Ọnụ ụzọ nnabata: Mee iwu SBOM na-enyocha pull requests ma na-ewulite, na-egbochi njikọta enweghị nchekwa.
- Ihe nzuzo na nchọpụta malware: Gbasaa SBOMnwere ike ịhụ ihe nzuzo ndị e tinyere n'ime ya ma ọ bụ ụkpụrụ koodu ọjọọ.
- Idozi akpaghị aka nke AI: Mepụta nchekwa pull requests yana ndozi ndị maara ihe gbasara ya, na-atụgharị SBOM nchọpụta gbasara ndozi ozugbo.
- Nkwado: Gbaa mbọ hụ na nke ọ bụla SBOM a bịanyere aka na ya, a pụrụ ịchọta ya, ma tụkwasị ya obi.
Na mgbakwunye, itinye SBOM Mmepụta, nkwenye, na ndozi ka ọ bụrụ usoro ọrụ ndị mmepe na-agbanwe nrubeisi ka ọ bụrụ njikwa ihe egwu ngwanrọ na-arụ ọrụ nke ọma. Karịsịa, ọ na-enye ndị otu ike igbochi ihe egwu tupu ha erute mmepụta ma gosipụta ntozu oke n'oge nyocha.
Lelee otu Xygeni si emepụta SBOMs na gị pipeline
mmechi
The CISA SBOM Ihe kacha nta 2025 gosi nke ahụ SBOMs bụzi akụkụ dị mkpa nke nchekwa ọgbara ọhụrụ. Site n'imeziwanye SBOM standards ma tinye ha ozugbo na mmepe pipelines, CISA na-eme ka ụlọ ọrụ dị iche iche nwee ike iru ihe doro anya, akpaaka, na ịga n'ihu njikwa ihe egwu ngwanrọ.
N'ihi ya, ndị otu na-agbaso omume ndị a na-enweta ọ bụghị naanị nrubeisi kamakwa ike siri ike. Site na Xygeni, ị nwere ike ịmepụta nrubeisi. SBOMs, tinye ihe dị mkpa bara uru, ma chekwaa ihe nkesa gị pipelines na-enweghị ibelata mmepe.
Debe ngosi ngosi gị taa lee ka Xygeni si eme ya CISA SBOM nrubeisi dị mfe.
