Kwa zaka zambiri, owukira ankafunafuna mapulogalamu amodzi ndi amodzi. Asintha njira: bwanji kusokoneza pulogalamu imodzi pomwe mungathe kusokoneza pipeline Zimenezo zimamanga ambiri? Xygeni's Chenjezo Loyambirira la Malware (MEW) wapezeka Ma phukusi 4,452 oipa mu 2025 ndi Ena 1,281 mu 2026 mpaka panoChochitika chilichonse chodziwika bwino chazaka zingapo zapitazi chafika paubwenzi wosiyana mu unyolo wopereka mapulogalamu:
- SolarWinds (2020): mgwirizano pakati pa zomangamanga ndi chilengedwe; zosintha zakumbuyo zatumizidwa kwa makasitomala 18,000.
- Codecov (2021): chithunzi cha Docker chosakonzedwa bwino chimalola owukira kusintha script ya bash uploader, kutulutsa zinsinsi za CI kuchokera kwa makasitomala oposa 23,000.
- CircleCI (2023): kuba ma cookie a session-cookie pa laputopu ya mainjiniya kunasanduka ma tokeni opezera zinthu; kasitomala aliyense anauzidwa kuti azisinthasintha chinsinsi chilichonse.
- XZ Utilits backdoor (2024) : kampeni ya zaka zambiri yaukadaulo wa anthu yomwe inafika pafupifupi pafupifupi kugawa kulikonse kwa Linux.
- zochita za tj (2025) — njira yopezera zinthu ya GitHub Actions yomwe inawononga chinthu chomwe chimagwiritsidwa ntchito ndi malo osungiramo zinthu opitilira 23,000.
- Kuukira pa Madzi Otentha ndi Malangizo (2026) — kampeni ya TeamPCP inasintha ma scanner awiri achitetezo omwe amagwiritsidwa ntchito kwambiri kukhala ma vector a ziwopsezo, kenako inagwiritsa ntchito shoulded CI/CD ziyeneretso zolowera pansi mu npm, OpenVSX, ndi PyPI.
Kuukira kulikonse kunagwiritsa ntchito mbali yosiyana ya pipeline: malo omangira, kugwiritsa ntchito zida za CI, kudalira, ziyeneretso za opanga mapulogalamu, chidaliro cha wosamalira, maumboni osinthika ku zinthu zakale. Mabungwe ambiri amayankha ndi point control, scanner mu CI, 2FA pa IdP, chitetezo cha nthambi pa mainChomwe nthawi zambiri chimasowa ndi njira yofunsira Kodi timakhudzidwa mwadongosolo? m'malo moti Kodi tinakumbukira kuyatsa X pambuyo pa chochitika chomaliza?
Ogulitsa chitetezo cha mapulogalamu amakhala ogwirizana, zomwe zimapangitsa kuti kasitomala aliyense amene amadalira zinthu zake asamavutike. Kukakamizidwa kuchoka pa zowongolera zosinthika kupita ku kaimidwe kokhazikika si nkhani yongopeka. Zimenezo ndi zoyamba.cischomwe chinapangitsa kuti pakhale OWASP SPVS standard ngati pulojekiti yofunika kwambiri.
Kodi SPVS Ndi Chiyani, Ndipo Chifukwa Chake Kapangidwe Kake Ndi Kofunika?
Nkhani yoyambira ndi yosavuta. Pa LASCON 2023, Farshad Abasi ndi Cameron Walters ankafunsana funso lomwelo: kodi ASVS ya chiyani? pipelineKodi OWASP ASVS inapereka chitetezo cha pulogalamu yonse komanso chotsimikizika standardPalibe chofanana ndi ichi chomwe chinalipo pa CI/CD.
Panali OWASP Top 10 CI/CD Zoopsa, zomwe zinali zoganizira za chidziwitso, zomwe sizingathe kuyesedwa; SLSA, yomwe inkayang'ana kwambiri pa chiyambi cha kapangidwe kokha; S2C2F, yomwe inkayang'ana kwambiri pa kugwiritsa ntchito mankhwala odalira okha; ndi OpenSSF Khadi la zigoli, lomwe linkaphimba macheke enieni a malo osungiramo zinthu. Chilichonse chinali ndi gawo lake. Palibe chomwe chinali ndi gawo lonse.
| Chimango kapena Pulojekiti | Primary Scope |
|---|---|
| OWASP Wapamwamba 10 CI/CD Kuwopsa | Zoganizira za chidziwitso CI/CD chitsogozo cha zoopsa, osati chitsimikizo choyesedwa standard. |
| SLSA | Pangani chiyambi ndi umphumphu wa zinthu zakale. |
| Chithunzi cha S2C2F | Kugwiritsa ntchito zinthu modalira kwambiri. |
| OpenSSF Zolemba | Kuyang'ana chitetezo chapadera pamlingo wa malo osungiramo zinthu. |
Kusiyana: chimango chilichonse chinali ndi gawo lofunika la software supply chain security, koma palibe amene anapereka umboni wotsimikizira kuyambira kumapeto mpaka kumapeto standard yonse CI/CD pipeline.
Kukambirana kumeneko kunakhala zaka ziwiri za ntchito, ndipo mu Okutobala 2025 gulu logwira ntchito la SPVS linatulutsa v1.0: zofunikira 127 pa moyo wonse, Konzani, Pangani, Phatikizani, Tulutsani, Gwiritsani Ntchito, zomwe zinagawidwa m'magulu atatu okhwima: L1 Foundational, L2 Standard, ndi L3 Advanced. Chofunikira chilichonse chimayikidwa mu NIST SP 800-53, OWASP CI/CD Top 10, ndi CWE.
Kapangidwe kake ndiye mfundo yaikulu. M'mawu a olemba a SPVS:
"Tsimikizirani zonse zomwe mwalemba pipeline, osati chidutswa chimodzi chokha. Apa ndi pomwe mabungwe ambiri amavutika. Amafufuza zinthu zodalira koma amanyalanyaza kayendetsedwe ka kutulutsidwa. Amasaina zinthu zakale koma sawopseza kuti agwiritse ntchito chitsanzo chawo. pipeline zomangamanga. Amayang'anira kupanga zinthu koma osati malo omwe amamangira zinthu.
Apa ndi pomwe mabungwe ambiri amavutika. Amafufuza zinthu zomwe zimawadalira koma amanyalanyaza malamulo okhudza kutulutsidwa kwa zinthu. Amasaina zinthu zakale koma sawopseza kuti agwiritse ntchito njira zawo. pipeline Amayang'anira kapangidwe ka zinthu koma osati malo omwe amamangira.
Iyi ndi mfundo yomwe imatsimikizira khama. Mphamvu mu gawo limodzi sizimalipira zofooka mu gawo lina. Owukira amangofunika ulalo umodzi kuti asweke. Moyo wonse standard Zimakukakamizani kuti muyang'ane zonse, ndipo kupita patsogolo kwa L1 kupita ku L2 kupita ku L3 kumakulolani kuchita izi popanda kuwiritsa nyanja. SPVS siilowa m'malo mwa SLSA, S2C2F, Scorecard, kapena Sigstore; imakupatsani scaffolding yomwe imakuuzani komwe chilichonse chikuyenerera.
Kusintha Standard ku Bungwe Lanu
Gawo loyamba lachilengedwe ndikuwunika mosamalitsa bungwe lanu ndi zomangamanga za mapulogalamu anu malinga ndi zofunikira zonse. Google Sheet yochokera kwa mkulu wa boma. Zofunikira za SPVS CSV imagwira ntchito bwino ngati poyambira. Mawonekedwe atatu ndi othandiza: matrix ya zofunikira yokhala ndi udindo ndi mwiniwake pa ulamuliro uliwonse, mapu otenthetsera pa malo osungira, ndi dashboard za kupita patsogolo pa gawo ndi mulingo. Zotsatira zake zimalowa mwachibadwa mu dongosolo laukadaulo, chikalata chamoyo chomwe chimaphimba gawo lililonse kuyambira dongosolo mpaka ntchito.
Mabungwe ambiri okhwima aukadaulo adzadzipeza ali kale pafupi ndi L2 akamakonza mapu oyamba awa. Izi zikutanthauza kuti gawo loyamba likhoza kuyang'ana kwambiri pakutseka mipata inayake m'malo momanga maziko kuyambira pachiyambi.
Komabe, spreadsheet ndi chithunzithunzi, ndipo SPVS ikupempha zambiri. V1.1.7 imafuna kuti oyang'anira VCS aziwunika kotala lililonse; V5.1.1 mpaka V5.1.3 imawonjezera ma audit okhazikika a ogwiritsa ntchito, kuwunikanso kwa access-log, ndi kuwunika mwayi wopeza; zowongolera zingapo za V2.1.x, V3.3.x, ndi V4.2.x zimafuna ukhondo wopitilira wa ntchito-YAML. Kuyendetsedwa ndi manja m'bungwe lonse, ndiko kuti, kudina-kutsata kotala lililonse ndi chiopsezo chenicheni cha kuchotsedwa mwakachetechete. Ndi mtundu wa ntchito womwe umadzipangira wokha kapena umawunikidwa kokha pambuyo poti chinthu choipa chachitika.
Zina mwa zinthu zowongolera za SPVS si zinthu zongoyang'aniridwa kamodzi kokha. Zimafunika kuwunikanso mobwerezabwereza, umboni wowunikira, ndi kuzindikira momwe zinthu zilili m'malo osungiramo zinthu, ogwiritsa ntchito, ntchito, komanso mwayi wopeza zinthu mwapadera.
| Malo a SPVS | Mtundu Wofunika |
|---|---|
V1.1.7 | Kuwunika kwa oyang'anira VCS kotala lililonse. |
V5.1.1–V5.1.3 | Kuwunika kwa ogwiritsa ntchito nthawi zonse, kuwunikanso zolemba za anthu omwe ali ndi mwayi wopeza, komanso kuwunika momwe anthu alili ndi mwayi wopeza zinthu. |
V2.1.x, V3.3.x, V4.2.x | Ntchito yopitilira ya YAML ya ukhondo. |
Yankho lake ndi kupanga kapena kugwiritsa ntchito zida zomwe zimagwira ntchito motsatira chizindikiritso cha mwini bungwe ndikupanga phukusi lokonzedwa kotala lililonse: mndandanda wa oyang'anira, chitetezo cha nthambi, kuphimba kwa CODEOWNERS, ukhondo wa YAML wa ntchito ndi zochita zolembedwa, zilolezo zomveka bwino, pull_request_target kutseka, membala wa 2FA, kuyika ma GitHub Apps, ndi makiyi otumizira. Zomwe zinali theka la tsiku la spreadsheet archaeology zimakhala lamulo limodzi lotulutsa JSON ndi Markdown. Kuwunikanso kwa kotala pakati pa CISO ndi oyang'anira bungwe amakhala decismsonkhano wa ion, osati msonkhano wosonkhanitsa deta, ndipo zomwe zapezeka zitha kuchitidwapo kanthu zimakhala nkhani zotsalira ndi ma SLA ozikidwa pa kuopsa.
Ndondomeko ya mndandanda wololeza, kuphatikizapo oyang'anira ovomerezeka, mapulogalamu ovomerezeka, ndi zilolezo zochokera ku malo osungiramo zinthu ndi ntchito, ziyenera kukhala ngati YAML m'malo osungiramo zinthu omwe amayendetsedwa ndi mtundu, otetezedwa ndi ndemanga ya PR kuchokera ku gulu lachitetezo. Kusintha kulikonse kwa mndandanda wololeza kumasiya njira yowunikira, kotero umboni wowunikira umadzipanga wokha. Zotsatira zake ndikusintha zowongolera zomwe zinali zofunidwa, monga "tiyenera kuwunika kotala," kukhala zomwe zimachitika nthawi zonse, monga "kuwunika kotala lino kudafika Lolemba," ndikupatsa bungwe njira yobwerezabwereza yodziwira kusuntha komwe mfundo yoyambira mpaka kumapeto imafuna.
Mikangano Yomwe Muyenera Kukonzekera
Kuwongolera zaukadaulo ndikosavuta. Anthu ndi ovuta.
Chitsanzo chabwino kwambiri nthawi zambiri chimakhala cha CODEOWNERS. .github/workflows/ @your-org/security Pa repo iliyonse imamveka ngati yopanda pake. Fayilo imodzi, mzere umodzi. Koma zikutanthauza kuti mainjiniya omwe akhala akudziphatikiza okha kusintha kwa ntchito kwa zaka zambiri tsopano akufunika kuwunikanso chitetezo. Ngakhale anthu osamala za chitetezo amatsutsa: Ndinalemba ntchito iyi, ndikumvetsa, bwanji ndikudikira?
Pamafunika kukambirana kwenikweni kuti tidziwe chifukwa chake. Mayendedwe antchito amatha kutulutsa ziphaso, kutumiza zinthu zakale, ndikuwononga ogula omwe ali pansi pa madzi. Maso awiri achiwiri si kusakhulupirirana; ndi lingaliro lofanana ndi kusintha kwa database yopanga zinthu. Kukhala ndi chochitika chenicheni, chaposachedwa chokhudza unyolo wogulira, kaya kuchokera kumakampani kapena malo anu, kumathandiza kwambiri. Palibe chomwe chimapangitsa kuti ulamuliro ukhale wofanana ndi chitsanzo chenicheni cha kusakhalapo kwake.
Ma friction ena amatsatira mawonekedwe omwewo:
- Zilolezo zoonekeratu: Kutsekeka kwa ntchito kumapangitsa kuti CI ilephereke mpaka omwe amapereka chithandizo atamvetsetsa zilolezo zogwiritsidwa ntchito. Ili si vuto la zilolezo, koma vuto la chitsanzo cha maganizo.
- Kusasinthika kwa tag: imaphwanya zida zotulutsira zomwe zakhala zikubwezeretsanso mwakachetechete kwa zaka zambiri.
- Wosayina commits: Pangani kusagwirizana kwa makiyi mpaka makiyi a GPG kapena SSH atakhazikitsidwa bwino m'malo ogwirira ntchito. SPVS imapangitsa izi kukhala zofunika kwambiri m'malo onse osungiramo zinthu ndi othandizira, osati m'malo akuluakulu okha.
- Kusintha ma tokeni akale opezera mwayi wofikira munthu payekha: m'malo ambiri osungiramo zinthu ndi mafayilo a ntchito amakhudza pafupifupi gulu lililonse.
Kachitidwe komwe kamagwira ntchito: kuyambitsa ulamuliro uliwonse ndi chiwopsezo china chake chomwe chimatseka, kuyesa malo amodzi kapena awiri osungiramo zinthu, kuyambitsa ndi zinthu zololedwa, ndikuchotsa zinthuzo pa nthawi yake. Mainjiniya omwe amaletsa kwambiri, nthawi zambiri, amakhala olimbikitsa kwambiri akangoona chifukwa chake.
Mfundo imodzi yozama: mfundo yoyambira mpaka kumapeto ikukhudza apa. Simungasankhe. Kulimbitsa gawo lomanga pomwe mukusiya ulamuliro womasuka kumapereka chidaliro chabodza, chomwe ndi njira yolephera yomwe olemba a SPVS amatcha. Gawo lililonse liyenera kupita patsogolo limodzi, ngakhale pamene ulamuliro winawake ukuwoneka wosiyana kwambiri paokha.
mtengo: Pafupifupi mwezi umodzi wa nthawi ya uinjiniya ya Gawo 1, yoyang'ana kwambiri kutsatira malamulo a L2 kwa bungwe laling'ono, yomwe imafalikira kwa DevOps, Security, ndi owunikira uinjiniya. Ndalama zomwe zayikidwa zimabwezera mosavuta. Chochitika chimodzi choletsedwa cha unyolo woperekera zinthu chimaphimba nthawi zambiri. Mabungwe akuluakulu ayenera kupanga bajeti yochulukirapo, koma kapangidwe ka L1 kupita ku L2 kupita ku L3 kamatanthauza kuti phindu liperekedwa pulogalamuyo isanathe.
Chotsatira N'chiyani?
SPVS v1.5 ili pafupi ndi zowongolera zokhudzana ndi AI: chiyambi cha code yothandizidwa ndi AI, guardrails pa ntchito za CI zomwe zimayitanitsa ma LLM, onaninso njira zopangira AI pull requests, ndi chitetezo ku ziwopsezo zomwe zikubwera monga slopsquatting, komwe owukira amalembetsa mayina a phukusi omwe othandizira olemba ma code a AI amawona zinthu ngati zilombo, ndi pulogalamu yaumbanda yopangidwa ndi AI yomwe CrowdStrike imanena kuti ili kuthengo. Mabungwe omwe kale amalemba kuti AI-assisted commitMa s ndi ma PR m'malangizo awo a chitukuko chamkati adzapeza kuti kusinthaku kukuchitika pang'onopang'ono osati pulogalamu yatsopano yogwirira ntchito.
Mtundu 2.0 ukuyembekezeka kukulitsa kuwunika nthawi yogwirira ntchito komanso zofunikira pa moyo wa ziphaso. Ndondomeko yoyenera yoyendetsera bungwe: kutseka mipata yotsala ya L3 pofika kumapeto kwa kotala lachiwiri la 2026, kuphatikiza SLSA provenance ophatikizidwa mu standard CI/CD, zipata zoyendetsera ntchito pamanja, ndi wopereka chidziwitso chapakati, kenako amasamutsira ku njira yokonzera. Malo atsopano aliwonse amayamba kutsatira malamulo, ndipo kafukufuku aliyense wa kotala amachitikira msanga.
Zikomo kwambiri kwa Farshad Abasi, Cameron Walters, ndi gulu logwira ntchito la OWASP SPVS. Mapulojekiti ngati awa amachepetsa malire a bungwe lililonse lomwe likufuna kuchita chitetezo cha unyolo wopereka zinthu mwadongosolo m'malo mochitapo kanthu.
Zitengera Zapadera
Zinthu zingapo zomwe zimatipangitsa kupitirira zomwe tikunena:
- Kuyesa: Tsitsani CSV ya zofunikira za SPVS ndikuyika mapu a zowongolera zomwe muli nazo pano mu spreadsheet. Mudzadziwa mkati mwa tsiku limodzi ngati zikugwirizana.
- Sankhani mulingo umodzi wofunikira ndikutumiza musanafikire wina. Kuchoka ku L1 kupita ku L2 kupita ku L3 ndi chinthu china, osati choletsa.
- The pipeline ndiye cholinga. Kuwongolera komwe kumayang'ana pa ntchito ndikofunikira koma sikokwanira; thandizani pipeline ngati malo owukira oyamba.
- Tsimikizani zonse pipeline, osati chidutswa chimodzi. Kulimba kwa kusanthula kudalira sikulipirira kayendetsedwe kofooka ka kutulutsidwa kapena malo omanga osayang'aniridwa.
- Ma spreadsheet ndi zithunzi; kuyenda kwake kumakhala kosalekeza. Pangani makina odzichitira okha, ngakhale chida chosavuta mkati, kuti muwone kusinthasintha pakati pa ma audits.
- Ntchito yokonza zinthu ndi yovuta kuposa ntchito yaukadaulo. Konzani nthawi yokambirana ndi kuyesa musanagwiritse ntchito, ndipo fotokozani zoopsa zomwe zimalepheretsa ulamuliro uliwonse.
Kuti Muwerenge Zambiri
- OWASP: otetezeka Pipeline Yotsimikiza Standard (SPVS) v1.0Tsamba la Pulojekiti ya OWASP.
- Farshad Abasi: Chifukwa Chake Tinapanga OWASP SPVSNkhani za OWASP SPVS.
- Farshad Abasi: Pipeline Ziwopsezo Zikuipiraipira. Nayi Momwe MungakonzekerereNkhani za OWASP SPVS.
- Farshad Abasi: OWASP SPVS vs. Ma Framework Ena OgulitsaNkhani za OWASP SPVS.
- OWASP: Top 10 CI/CD ZoopsaTsamba la Pulojekiti ya OWASP.
- SLSA: Miyezo Yogulira Zinthu Zapulogalamu.slsa.dev.
- OpenSSF: Zolemba.securityscorecards.dev.
