Muchinyorwa chedu chekare nezve CI/CD Pipelines, takaona maitiro ekubira a CI/CD mamiriro ezvinhu ekuti zvimwe yakachengetedzwa.
Ngatiyeukei pfungwa yedu muchinyorwa chapfuura: takatanga nezvimwe pipeline izvo zvaive nyore ku Chepfu Isina Kunanga Pipeline kuuraya (I-PPE) uye, kuti tigadzirise, takasarudza kupatsanura pipeline kuita zviviri:
- Yekutanga pipeline (Kuvaka CI), yakachengeteka kuD-PPE neI-PPE, yaizotarisa kodhi yePR, yogadzira, uye yogadzira chinhu chekare.
- Yechipiri pipeline (Test CI), iyo yakachengetekawo kuD-PPE neI-PPE yaizotarisa Base code (kudzivirira kugadziriswa kweshell script) uye yoita script dzepakutanga dzichipesana nechinhu chakagadzirwa.
- Kuenzanisa Test CI pipeline kumhanya PASHURE peBuild CI pipeline, takashandisa workflow_run trigger.
Takatumidza izvi kuti Mamiriro #3.
Kunyange zvazvo, sezvatakataura muchinyorwa ichocho, kune dzimwe mhinduro, takasarudza kushandisa "mhinduro" iyi nekuda kwezvikonzero zvekudzidzisa, kuitira kuti tikwanise kunyura zvakadzama mumatambudziko e CI/CD pipelines.
Mushure mezvo, takaona kuti tingagadzirisa sei mamiriro ezvinhu aya nekushandisa kuchetura chinhu chachoIzvi ndizvo zvatinodaidza kuti Chepfu yezvigadzirwa, kureva kugona kugadzirisa (hack) iyo pipeline pfungwa nekushandura a pipeline artifact.
Dambudziko nderei nemaitiro aya? Takaona kuti dambudziko rinomuka kana chero mushandisi "agadzira" imwe nzira itsva pipeline.
Kana mushandisi akavhura PR ine itsva pipeline, GitHub ichaita izvozvo pipeline (tichifunga nezvezvimwe zvinodiwa, sezvatakaona mupositi).
Mushandisi anobva akwanisa kugadzira imwe itsva pipeline ine zita rakafanana neBuild CI!! Ehe, zvinoshamisa, asi GitHub inokutendera kuti ugadzire maviri pipelinerine zita rimwe chete!!
Kana mushandisi akavhura PR ine shanduko idzi, "itsva" pipeline zvichaitwa (kurodha chinhu chine chepfu) uye CI yeDeploy pipeline zvichaitwa mushure meizvozvo, zvichiita kuti script ye "modified" shell inyore pamusoro pescript ye "original" shell iri mu pipeline nzvimbo yebasa. Saka, "mhinduro" iyi haidziviriri kushaya simba kweI-PPE (sezvatinoona pazasi)
Matambudziko acho ndeapi? Pane zvimwe zvinhu zviviri:
- Chekutanga, ungava sei nechokwadi chekuti maitiro ekuvaka haana kukanganiswa? Muchiitiko ichi, mushandisi ane utsinye akakwanisa kugadzirisa maitiro ekuvaka aakaronga nekushandisa yavo pipeline kugadzira chinhu chine chepfu.
- Chechipiri, Tingaongorora sei kubva kwechinhu chakagadzirwa?
Mibvunzo iyi inotipinza mumaoko e Zvipupuriro zveSoftware nzvimbo!!
Zvipupuriro zveSoftware
An kupupurira chikamu che dhata anomiririra humbowo hwechiitikoMunyika chaiyo, tinowanzoti izvi zvituko.
Semuenzaniso, kana rabhoritari ikaongorora ropa rako, ruzivo nezvebvunzo yacho runonyorwa uye runosimbiswa. Mhedzisiro yekuongororwa kweropa ndeye chechokwadi uye zvinoteedzana.
Padyo nenzvimbo yedu yeIT, unogona kufungidzira kuti chii chingave kushandurwa kwemaitiro aya, semuenzaniso, maitiro ekuunganidza.
Ruzivo nezvenzvimbo yekubatanidza server uye maturusi, zvinhu (kodhi yemuchina), uye zvigadzirwa/zvinhu zvakagadzirwa (kodhi yebhinari) zvingave chikamu cheuchapupu hwakadaro.
Zviri pachena kuti humbowo hunofanira kugadzirwa nemupupuri ane mvumo (hunosimbiswa uye husingarambike) kuti huve hwakavimbika.
Pamwe, vamwe venyu mungave muchifunga kuti .. uye chii chinonzi musiyano uripo pakati pemasaini nemaaffidation?
Code Siginicha uye Zvipupuriro
Padanho repamusoro, siginicha inogadzirwa uchishandisa kiyi mbiri nechigadzirwa. Kiyi mbiri ine kiyi yeruzhinji nekiyi yakavanzika.
Mushandisi anosaina chinhu chekare achishandisa kiyi yakavanzika, uye vamwe vanogona kusimbisa siginecha vachishandisa kiyi yeruzhinji. Kiyi yakavanzika inofanira kuchengetwa yakavanzika, asi kiyi yeruzhinji inoparadzirwa zvakanyanya.
Masaini anogona kushandiswa kuratidza kuti muridzi wekiyi yakavanzika akashandisa kiyi yakavanzika kusaina chinhu chacho.
Zvinyorwa usaratidze
- Yemushandisi chinangwa kusaina chinhu chacho (vangangodaro vakanyengerwa), kana
- Chinangwa chemushandisi chekugadzira chero chirevo chaicho nezvechinhu ichi
ne Zviratidzo, pane kusaina chinhu chakagadzirwa zvakananga, vashandisi vanogadzira imwe mhando ye Document kuti inobata chinangwa chavo mushure mekusaina chinhu chacho uye chero chipi zvacho zvirevo zvakananga ichiitwa sechikamu chesaini iyi.
Framework yeUmboo Hwakadzikama
Chimiro chinowanzo shandiswa ndicho Chimiro cheChipupuriro cheIn-Toto
- inotsanangura a standard fomati yezvipupuriro zvinobatanidza nyaya, zvinhu zviri kutsanangurwa, kune metadata yakatenderwa nezvechinhu chacho
- inopa seti ye zviratidziro zvakatsanangurwa kare yekutumira metadata yechokwadi mukati uye mukati memaketani ekupa software
Ngatinyatsoongororai zvakadzama nezvechimiro chekusimbisa.
An Chipupuriro ndiwo gwaro rakasainwa nedhijitari izvo zvine Mashoko.
The Statement ndiyo chikamu chepakati chechipupuriro, ichichibatanidza kune chimwe chinhu chidzidzo uye kuziva zvakajeka mhando dze Kufanotaura:
- chidzidzo: a kuchengetedzwa kwekrispiti kune chinhu chakagadzirwa (kazhinji kuburikidza ne hash), uye
- Zvinoreva: seti yezvakananga zvinodaro nezvechinhu ichocho chinonzi Statement. Izvi zvinogona kushandiswa kuratidza (uye kuratidza gare gare) chero chaungafunga nezvacho! Zvinogona kumiririra mvumo yemaoko, kubva pane chinhu chacho, mhinduro dzebvunzo dzinoitwa otomatiki, nzira yekuongorora, kana zvimwe!
Kana Chirevo ichi chasainwa nenzira ye cryptographically, chinobva chanzi "cryptographical" Chipupuriro
Nenzira iyi, semuenzaniso, Alice anogadzira Chirevo nezvechinhu chakagadzirwa uye anochisaina achishandisa kiyi yake yakavanzika, achigadzira Chiratidzo.
- Bob anogona ipapo simbisa siginicha muChipupuriro ichocho, zvichimubvumira kuvimba nezvinotaurwa mukati.
Bob anogona kushandisa zvirevo izvozvo kusarudza kuti chibvumirwe here kana kuti kwete kuti chinhu ichi chishandiswe.
Zvipupuriro zvinogona here kubatsira kugadzirisa chepfu yeArtifact?
Mushure mekutanga uku kweAttestations, ngatidzokerei kudambudziko redu. Zvipupuriro zvingatibatsira sei kugadzirisa dambudziko redu, kureva kudzivirira chepfu yezvinhu zvechinyakare?
Mushandisi ane utsinye akakwanisa kugadzira chinhu chinopfuura nzira "yepamutemo", kureva nekushandisa yake/yake pipeline kugadzira chinhu chacho.
Zvingava zvinoshamisa kudai taigona kuratidza kuti zvinhu zviri kutorwa zvakavakwa nemutemo. pipelines. Uyu muenzaniso mumwe chete wezvatingati "nzvimbo dzekugadzirisa zvinhu", asi panogona kunge paine mimwe yakawanda.
Sezvauri kuona mumufananidzo uri pamusoro, nzvimbo dzekukanganisa dzakawanda. Nenzira iyi, mutengi pipeline (Test CI mumuenzaniso wedu) inofanira kuongorora kuvimbika kwemaitiro ekuvaka pamwe ne kuvimbika kwechigadzirwa chacho pachacho.
Mumuenzaniso wedu, chinhu chine chepfu chakagadzirwa nekuunza chinhu chitsva (chine chepfu) pipeline izvo zvinokanganisa maitiro ekuvaka. Asi mushandisi ane hukasha angadai akakwanisa:
- gadzirisa kodhi mushure mekubviswa kubva ku SCM kugadzira binary ine njodzi
- tsiva binary chaiyo inogadzirwa nekubatanidzwa neimwe binary ine njodzi
- kukanganisa Artifact Registry uye kuisa chinhu chine chepfu chakavakwa neimwe nzira
- etc.
Sezvaunogona kuona, panogona kunge paine nzvimbo dzakawanda dze "kukanganisa".
Chii chakakosha pano? Zviri pachena kuti tidzivirire pfungwa dzese idzodzo "dzinokuvadza". Asi, pakupedzisira, chinonyanya kukosha ndechekuti kuti "mutengi" wechinhu ichi anogona kuongorora kuvimbika kwechigadzirwa chacho, uye osarudza kana oenderera mberi nacho kana kuti kwete.
Tinogona kuongorora kuvimbika kwechinhu chakagadzirwa munzira mbiri.
Imwe ndeyekuongorora provenance yechinhu chacho.
Nekugadzira a Chiratidzo chekwakabva, tinopa ruzivo runobatsira (rwakasimbiswa nemazvo uye rusingarambwe) nezvechinhu ichi. Mumienzaniso inotevera, tichashandisa Munyu weXygeni (Software Attestations Layer for Trust), chikamu chekugadzira, kunyoresa, uye kusimbisa zvitupa zvesoftware.
Mune kodhi iri pamusoro, unogona kuona kuti pane danho rinovaka faira rehondo uye danho rechipiri rinogadzira Chiratidzo chekwakabvaKuti zviitwe, pipeline inoshandisa kiyi yakavanzika uye inosanganisirawo kiyi yeruzhinji muchiratidzo.
Seri kwezviitiko, Xygeni's munyu murairo unochengeta chipupuriro mu ledger (inozivikanwawo se registry ye affidation, rekodhi mune yedu asi unogona kushandisa chero imwe). Zvaitwa izvozvo, mutengi pipeline zvinogona kusanganisira Xygeni's Injini Yekusimbisa kuona kuti chinhu chacho chakabva kupi uye kuongorora kuti chinhu chacho chakarurama here.
Maitiro ekusimbisa anoongorora:
- The sha256sum yechinhu chekare inoshanda (kureva kuti pane humbowo nezve "nyaya" iyoyo), uye
- The humbowo hwacho hwakasimbiswa nemazvo (yakagadzirwa nekushandisa kiyi yakavanzika yakakwana)
Maitiro aya ekusimbisa anogona kuona kuti zvese zviri zviviri chinhu chakagadzirwa uye chisimbiso zvinoshanda.
Asi, sezvamunoyeuka, kwatiri, chinhu ichi chakagadzirwa ne "chinokuvadza" pipeline (kureva kuti kwete yekutanga neyakagadziriswa pipelineZvadaro tinofanira kuenderera mberi toongorora chimwe chinhu: icho chinhu chakagadzirwa ne "yepakutanga" pipeline, kwete imwezve.
Kuti uite izvozvo, ingoisa mutsetse uri nyore kuti utarise mamiriro acho, semuenzaniso:
Kuongorora uku kwakawedzerwa kuchakundikana dai chinhu chacho chisina kugadzirwa ne "safe" yedu pipeline.
Kana chinhu ichi chakagadzirwa nechinhu chedu chekutanga pipeline (cicd_top10_3_salt/.github/workflows/build.yml), murairo we grep uchabudirira, zvikasadaro, uchakundikana, uchityora pipeline uye kusatora matanho ekuwedzera.
"Muvaki" pipeline ingori imwe chete nzvimbo yekukanganisa asi, sezvambotaurwa, kune dzimwe nzvimbo dzekukanganisa dzatinofanira kutarisa.
Semuyenzaniso, Ko kana kodhi yekodha yakakanganiswa mushure mekubhadhara repo uye usati watanga kuraira? Muchiitiko ichi, kodhi inofanira kuvakwa haina kufanana neyakachengetwa mu SCM.
Kutarisa nzvimbo iyi yekukanganisa kuri nyore zvekuti unoongorora mashes echinhu chacho padanho rega rega.
mhedziso
Muchidimbu, a Chisimbiso cheSoftware kutaura kwakaitwa pamusoro pechinhu chesoftware, kureva chirevo chakatenderwa (metadata) nezvechinhu chakagadzirwa nesoftware kana muunganidzwa wezvigadzirwa zvesoftware.
Zvipupuriro zveSoftware zvinoreva kusanganisa kusaina kwechinhu chisina kugadzirwa/kodhi. Chipupuriro ichi gwaro rakasainwa (mufomati yakapihwa, inowanzo shandiswa paJSON) rinobatanidza metadata nechinhu chisina kugadzirwa. Izvi zvinomiririra humbowo hunobatanidza zvinopinda (zvinhu) uye zvinobuda (zvinhu zvakagadzirwa) padanho rega rega rekuvaka.
Zvipupuriro zvinopa chinyorwa chinosimbiswa chematanho akaitwa pakuvaka zvigadzirwa zve software zvekupedzisira, kusanganisira zvinhu zvekupinda padanho rega rega uye mirairo yekuvaka inomhanya.
Mukupedzisa, Software Attestations inzira yakanaka yekutarisa kuvimbika kwakasiyana-siyana kwemaitiro edu ekuvaka.
Wapedza nhevedzano iyi here? Usazvidya moyo! Inzwa wakasununguka kudzokera ku'Akaiswa chepfu Pipeline Kuuraya (PPE)' kana chero imwe positi inokukurudzira zvakare!
Rambai makagadzirira, tichanyatsoongorora zvipupuriro zvesoftware uye build security mune zvimwe zvinyorwa zveblog.
