Kei te piki haere ngā whakaekenga mekameka tuku pūmanawa i tētahi tere kāore i kitea i mua. E ai ki Haumarutanga, kua piki ake ēnei whakaeke mā te 742 orau i ngā tau e toru kua pahure ake nei, e whakamārama ana kāore e ranea ngā mahi haumaru tuku iho. Hei whakautu, ko te Ngā Taumata mekameka tuku mō ngā Taonga Pūmanawa (SLSA) i whakawhanakehia he anga hei āwhina i ngā whakahaere ki te whakapakari i ā rātou tukanga whakawhanake pūmanawa mai i te tīmatanga ki te mutunga.
He aha te Anga SLSA?
Puna: SLSA
Te SLSA anga (Ngā Taumata mekameka tuku mō ngā Taonga Pūmanawa), i whakapuakina "salsa" he anga haumarutanga whānui e tiaki ana i ngā pūmanawa mai i te whakawhanaketanga ki te whakatinanatanga. E tautuhi ana i ngā taumata haumarutanga e whā, ia taumata e hangai ana ki te taumata o mua hei whakapai ake i te haumaru me te māramatanga o ngā pūmanawa puta noa i tōna huringa ora.
Anei tētahi tirohanga poto mō ngā taumata e whā:
- Taumata 1: Te Pono Taketake – Ka whakarite kia aunoa ngā hanganga me ngā taiao whakahaeretia, hei whakatakoto i te turanga mō te whai i ngā mea.
- Taumata 2: Pūtake – Ka whai i ngā pūtake o ngā taonga pūmanawa, me te whakarite kia taea ai te whai i ō rātou pūtake.
- Taumata 3: Haumarutanga – Ka whakatinana i ngā mana urunga me ngā hanganga ka taea te tārua hei kite i te takahi ture.
- Taumata 4: Haumarutanga Nui – E whakarato ana i te taumata tiaki teitei rawa atu me ngā hanganga ātete-whakarerekē, ā-hiri me ngā mana pūtake tino pakari.
He aha te mea nui ai te SLSA mō CI/CD Pipelines
I te mea kei te mahi a DevOps me CI/CD pipelineHei whakatere i te whanaketanga pūmanawa, ka whakaatuhia hoki e rātou ngā ngoikoretanga. Ka taea e ngā kaiwhakaeke te whakamahi i ēnei āputa, te werohanga i te waehere kino, te whakarerekē rānei i ngā whakawhirinakitanga. Ngā Taumata mekameka tuku mō ngā Taonga Pūmanawa e aro ana ki ēnei wero mā te whakarite kia haumaru, kia mārama, kia taea hoki te manatoko i ia taahiraa o te tukanga whanaketanga.
- Te Tirohanga me te Whai Aroturuki: Ka aroturukihia e te SLSA ia huringa me ngā wāhanga katoa o roto i tō pipeline, kia māmā ake ai te kite wawe i ngā ngoikoretanga.
- Ko te Tiaki TiakiKa tautuhia, ka whakaitihia hoki ngā mōrearea i mua i te whakamahinga kino.
- Standardwhakakahoretanga: Ka whakaratohia e te SLSA he tohu e mōhiotia ana standard hei tiaki i ngā taonga pūmanawa, hei whakarite i te ōritetanga puta noa i ngā tukanga whakawhanake.
Me pēhea te tautoko a Xygeni i te Whakatutukitanga o te SLSA
Ko te whakatutuki i ngā whakaritenga SLSA ehara i te mea ko te tirotiro noa i ngā pouaka haumarutanga, engari ko te tiaki i tō mekameka tuku pūmanawa me te pupuri i te tere me te whai hua o te whanaketanga. Mō ngā tīma DevOps, he uaua te whakataurite i te haumarutanga me te tere, inā koa i roto i ngā kamupene e tere haere ana. CI/CD pipelines. Koinei te wāhi e uru mai ai a Xygeni, e whakahaere aunoa ana i ngā mahi haumarutanga nui hei whakarite kia tutuki, kia hipa hoki tō mekameka tuku pūmanawa i te anga SLSA standards, me te kore e whakaroa i tō rerenga mahi.
1. Te Aunoa i te Pono Hanga – Taumata 1 o te SLSA
Ko te taahiraa tuatahi ki te haumaru i ngā pūmanawa ko te pumau. Ka whakauru a Xygeni ki roto CI/CD pipelines, te whakahaere aunoa i te aroturukitanga hanga me te whakarite kia whai ia hanga i tētahi tukanga ka taea te whakahoki, ka taea te manatoko. Mā te whakakore i ngā hapa ā-ringa me te whakaiti i ngā mōrearea haumarutanga, ka āwhina a Xygeni i ngā tīma ki te whakatutuki i te hanganga SLSA Taumata 1 me te kore he uaua. Ko te tikanga o tēnei, mai i te tīmatanga, ka tiakina ō hanga, ā, ka hāngai ki mahi pai.
2. Te Whakapūmau i te Pūtake me te Whai Aroturuki – Taumata 2 o te SLSA
He mea nui te mōhio ki te pūtake o ngā wāhanga o tō pūmanawa mō te haumarutanga. I te anga SLSA Taumata 2, ka aroturuki aunoa a Xygeni i te pūtake o ia taonga tuku iho, ka hangaia he rekoata pumau e kore e taea te whakarerekē. Me te tirohanga katoa ki roto i tō pūmanawa pipeline, ka taea e ngā tīma te whai i ia wāhanga ki tōna pūtake, kia māmā ake ai te kite i ngā huringa kāore i whakamanahia, me te ārai i ngā whakaekenga mekameka tuku.
3. Te Whakapakari i ngā Mana Haumarutanga, Taumata 3 o te SLSA
I te tipu haere o ngā tūmomo mōrearea haumarutanga, ka hiahiatia he parenga kaha ake. I te anga SLSA Taumata 3, ka whakauruhia e Xygeni ngā mana whakahaere haumarutanga matatau, pērā i te aroturuki whakawhirinakitanga wā-tūturu me te tātari taea te toro atu. Engari i te whakakīkī i ngā tīma ki ngā matohi, ka tātarihia e Xygeni ngā ngoikoretanga kāore e taea te whakamahi, ka taea ai e ngā kaiwhakawhanake te arotahi ki ngā mōrearea tūturu. Mā ngā tirotiro whakawhirinakitanga kua hangaia, ka arotakehia ngā wāhanga tuatoru i mua i te whakamahinga.
4. Te Whakatutuki i te Haumarutanga Nui rawa atu me ngā Hanganga Hermetic, SLSA Taumata 4
I te anga SLSA Taumata 4, ka eke te haumarutanga pūmanawa ki tōna taumata teitei rawa atu standardKo ngā hanganga Hermetic, e ārai ana i te whakawhirinaki ki ngā whakawhirinakitanga o waho, kāore anō kia manatokohia, he mea nui hei whakarite kia haumaru, kia kore hoki e taea te whakarerekē i ia hanganga. Ka aunoa a Xygeni i tēnei tukanga, me te whakarite kia hangaia ia taonga i roto i tētahi taiao whakahaeretia, motuhake. Mā te manatoko i ia taahiraa o te hanganga, te takiuru i ngā huringa, me te ārai i ngā whakarerekētanga kāore i whakamanahia, ka whakaratohia e Xygeni te tino whakapono ki te pono o te pūmanawa me te kore e whakaroa i te whanaketanga.
Mā te Xygeni, he māmā noa te whakatutuki i ngā whakaritenga SLSA, he aunoa, ā, he whakauru katoa ki roto i tō pūnaha. CI/CD pipelines.
Kia pehea te Xygeni Build Security Whakakaha i ngā Whakamanatanga SLSA
Ko te whakatutuki i ngā Taumata Mekameka Tuku mō ngā Taonga Pūmanawa ehara i te mea ko te aroturuki noa i ngā hanganga; me whai pūtake mai, manatoko, me te whakatinana tonu i te haumarutanga. Xygeni Build Security whakangāwari i tēnei tukanga mā te te whakaputa aunoa i te whakamanatanga, te whakamana, me te whakahaere, kia māmā ake ai te whakarite i te pono o tō pūmanawa me te kore e tāpiri i ngā mahi tāpiri mā ngā kaiwhakawhanake.
Te Whakaputa Aunoa i ngā Whakamanatanga
Ka tīmata te whakawhirinaki ki te pūmanawa mā te whakamana kaha, ka taea te whakamana. Ka hangaia aunoatia e te SALT (Software Attestations Layer for Trust) a Xygeni ngā whakamana e tutuki ana i te SLSA mō ia hanganga, e whakamana ana i tōna pono me te whai i tōna takenga mai. Mā tēnei ka whakarite kia tuhia, kia āraihia te whakarerekētanga, kia haumaru hoki ia taahiraa o te tukanga hanganga.
Manatoko Māmā me te Whakahaere Pokapū
Te whakahaere i nga taunakitanga puta noa i te maha pipelineKa taea e s te taumaha rawa. Ki te Xygeni, ka taea e ngā tīma te manatoko i ngā whakamanatanga me te kore e uaua, me te whakarite kia rite ia wāhanga pūmanawa ki ngā kaupapa here haumarutanga. Ka whakakotahi te tūāpapa Xygeni i te whakahaere whakamanatanga, ka whakarato i tētahi wāhi kotahi hei aroturuki, hei arotake, hei whakamana hoki i te tutuki i ngā Taumata Mekameka Tuku mō ngā Taonga Pūmanawa me NIST SP 800-204D standards.
Korekore CI/CD Whakaurunga mō te Whakatinanatanga Tere
Me mahi tahi te haumarutanga me ngā kaiwhakawhanake, kaua ki te whawhai ki a rātou. Ka hono pai a Xygeni SALT ki ngā mea o nāianei CI/CD pipelines, e tuku ana i te urunga raina whakahau (CLI) me te whakatinanatanga haumarutanga aunoa. Ahakoa kei te whakamahi tō tīma i a GitHub, GitLab, Jenkins, Azure DevOps rānei, ka taea e Xygeni te whakamana i te whakamanatanga wā-tūturu, kia mau ai te haumaru o ngā hanganga, ā, ka taea te manatoko katoa i roto i ngā taiao katoa.
Te Whakatutukitanga Mutunga-ki-Mutu me te Kore e Whakararuraru
Mā Xygeni ka māmā ake te tutuki i ngā whakaritenga SLSA mā te whakarite kia tautokona ia pūmanawa e ngā whakaū ka taea te manatoko mā te whakamuna. Me te manatoko aunoa, te aroturukitanga pūtake katoa, me te hōhonutanga o te CI/CD te whakaurunga, ka taea e ngā tīma te whakatutuki i te haumarutanga teitei rawa atu standardme te kore e whakaroa i te whanaketanga.
ki te Xygeni Build Security, he māmā noa iho te whakatutuki i te hanganga ture mō te whakamanatanga SLSA, he aunoa, ā, kua whakaurua katoatia ki roto i ō rerengamahi DevSecOps.
Ngā Tikanga Pai mō te Whakatinana i te Anga SLSA
Ko te whakauru i te anga Taumata Mekameka Tuku mō ngā Taonga Pūmanawa ki roto i ō rerengamahi me whakataurite i te haumarutanga me te whai huatanga. Mā te tīmata i ngā mahi iti, te whakauru i ngā kaipupuri hea, te whakamahi i te aunoatanga, me te whakahou i runga i ngā urupare, ka taea e koe tiakina tō mekameka tuku pūmanawa me te pupuri tonu i te tere. Anei te tautoko a Xygeni i ia taahiraa.
1. Whakahaerehia he Aromatawai Tuatahi
Arotakehia ō tukanga whakawhanake pūmanawa o nāianei, ā, tautuhia ngā āputa e pā ana ki ngā whakaritenga anga SLSA. Ka āwhina a Xygeni ki te mahere i ngā rawa me ngā whakawhirinakitanga nui. Ka tautuhia ngā ngoikoretanga, ā, ka whakamāramahia ngā wāhi hei whakapai ake kia tutuki ai te SLSA. standards.
2. Whakauru Moata ki nga Kaipupuri
Whakapūmau i te tautoko a ngā tīma whakawhanake, haumarutanga, me ngā tīma whakahaere mā te whakaatu i ngā painga o te whakaurunga SLSA, pērā i te whakaiti i ngā mōrearea o te mekameka tuku. Mā Xygeni ngā pūrongo mārama e whakarato, kia māmā ai te aro turuki i te ahunga whakamua me te mārama ki te uara o te SLSA mā ngā kaipupuri hea.
3. Tīmata Iti me te Tauine Ake
Whakamātauria he kaupapa hei whakamātautau i ngā mahi SLSA i runga i te tauine iti. Whakawhānuihia ki ngā kaupapa nui ake i te mea ka pai ake te noho o tō rōpū. Mā ngā taputapu a Xygeni ka māmā ake te tīmata me te whakamahi haere i ngā mahi SLSA, mai i ngā hanganga aunoa me te whai i ngā takenga mai o tō pūmanawa.
4. Whakauruhia ngā Mahi SLSA ki roto i ngā Rerenga Mahi o nāianei
Whakamahia te aunoatanga hei whakauru i ngā mahi SLSA ki roto i tōu CI/CD pipelines, te whakaiti i te kaha ā-ringa me te whakarite kia rite tonu. Ka hono hohonu a Xygeni ki CI/CD pipelines, te whakahaere aunoa i ngā mahi haumarutanga pēnei i te aroturukitanga hanga, te tātari whakawhirinakitanga, me te whakaputa pūtake.
5. Whakarato Whakangungu me ngā Rauemi
Me whakarite kia tino mārama ngā tīma ki ngā whakaritenga a te SLSA mā roto i ngā kaupapa whakangungu me ngā tuhinga mārama. Ka tautoko a Xygeni i te whakangungu me te whakauru kaimahi, me te whakarato i ngā atanga kaiwhakamahi ngāwari me ngā pūrongo taipitopito hei urutau ngāwari.
6. Arotakehia me te Whakahou i ia Wā
Arotakehia i ia wā te whai huatanga o ngā mahi a te SLSA, ā, whakarerekētia i runga i ngā urupare. Mā ngā pūrongo taipitopito me ngā tātaritanga a Xygeni ka taea e koe te wā aroturukihia, ā, whakarerekētia hoki ō rautaki haumarutanga.
7. Whakamahia ngā Rauemi Hapori SLSA
Whakauru atu ki te hapori SLSA mō ngā mahi pai rawa atu, ā, whai wāhi mai ki te whakapuaki i ō wheako. Ka tautoko a Xygeni i te tutuki i ngā whakaritenga, ā, ka āwhina i tō whakahaere kia hono tonu ki ngā mahi haumarutanga whānui.
8. Aroturuki me te Whakaū i te Whakatutukitanga
Whakatinanahia ngā tikanga aroturuki wā-tūturu me te whakatinanatanga aunoa hei whakarite kia tutuki tonu ngā whakaritenga ki te SLSA. Ka aroturuki tonu a Xygeni i ngā whakaritenga, ā, ka tukuna he whakatūpato aunoa mō ngā ngoikoretanga katoa, inā koa i roto i ngā wāhanga tuatoru. Ka whakauruhia tika te whakatinanatanga haumarutanga ki roto i tō CI/CD pipeline.
Te Whakapūmau i tō Ao Tūroa me Xygeni me SLSA
Ehara i te mea he kōwhiringa te tiaki i tō mekameka tuku pūmanawa, engari he mea nui. Ko te Anga SLSA ka hoatu he mahere mārama ki a koe hei tiaki i tō pūmanawa, mai i te haumarutanga taketake ki ngā tikanga ārai-whakarerekē matatau. Me Xygeni, ka taea e koe te whakahaere i ngā ture me te whakanui ake i ō tikanga haumarutanga, kia noho haumaru, kia kaha, kia rite hoki tō pūmanawa mō te heke mai.
Kei te hiahia koe ki te tiaki i tō mekameka tuku pūmanawa? Tirohia me pēhea e taea ai e Xygeni te āwhina i a koe ki te whakatutuki i ngā Taumata Mekameka Tuku mō ngā Taonga Pūmanawa standardme te tiaki i ō pūnaha matihiko i tēnei rā.
Ngā Pātai Auau: Te Mārama ki te Anga SLSA mō CI/CD Pipelines
Ko te SLSA te mea pai rawa atu Standard hoki CI/CD Pipelines?
Ko te SLSA (Supply-chain Levels for Software Artifacts) tētahi o ngā anga haumarutanga tino whānui, ā, e whakamahia whānuitia ana mō CI/CD pipelines. Ka whakaratohia he huarahi hanganga, taumata-maha mō te tiaki i te whanaketanga pūmanawa, e arotahi ana ki te pono o te hanganga, te pūtake, me te ātete ki ngā whakarerekētanga.
Ahakoa ehara ko te SLSA anake standard, he mea motuhake nā te mea:
- Ka kapi i te huringa ora katoa o te pūmanawa, mai i te pono o te waehere pūtake ki te whakatinanatanga.
- E tautuhi ana i ngā taumata haumarutanga mārama (1-4), kia taea ai te urutau mō ngā hiahia haumarutanga rerekē.
- Ka mahi tahi me ētahi atu anga haumarutanga pēnei i te NIST SP 800-204D me te OWASP's CI/CD Ngā Mōrearea Haumarutanga.
Mō ngā whakahaere e hiahia ana ki te whakapakari CI/CD haumarutanga, he kōwhiringa pai rawa atu a SLSA. Heoi, i runga i ngā hiahia ture motuhake, ka whai pea ētahi tīma i te NIST, CIS, ngā anga haumarutanga motuhake-ahumahi rānei me te SLSA.
Ko wai te Kaiwhakahaere o te Anga SLSA mō CI/CD Pipelines?
Kei raro i te mana o te SLSA OpenSSF (Open Source Security Foundation), he kaupapa Linux Foundation i whakatapua ki te whakapai ake software supply chain security. OpenSSF e mahi tahi ana me Google, GitHub, Microsoft, me ētahi atu kaiārahi ahumahi ki te whakawhanake me te whakapai ake i te anga SLSA.
Kei te whakahou tonu te rōpū mahi a te SLSA i te anga mahi hei aro atu ki ngā tūmomo riri hou, hei whakarite ki ngā mahi pai rawa atu, hei whakapai ake hoki i te whakamahinga haumarutanga i roto i CI/CD pipelines. Ka taea e te hunga e hiahia ana ki te whai wāhi atu, ki te noho tonu rānei ki ngā whanaketanga o te SLSA te whai wāhi atu ki OpenSSFte hapori me ngā rōpū mahi.
