Kurwiswa kwesoftware supply chain kuri kuwedzera nekukurumidza kusati kwamboitika. Sekureva kwazvino. SecurityWeek, kurwiswa uku kwakawedzera ne 742% mumakore matatu apfuura, zvichiratidza pachena kuti matanho ekuchengetedza echinyakare haachakwani. Mukupindura, Matanho eKugovera Zvinhu Zvishandiso zveSoftware (SLSA) hurongwa hwakagadzirwa kubatsira masangano kusimbisa maitiro avo ekugadzira software kubva kumagumo kusvika kumagumo.
Chii chinonzi SLSA Framework?
Kunobva: SLSA
SLSA Framework (Matanho eKugovera Zvinhu Zvitsva zveSoftware), zvinonzi “Salsa" ihurongwa hwakazara hwekuchengetedza hunodzivirira software kubva pakugadzirwa kusvika pakushandiswa. Inotsanangura mazinga mana ekuchengetedza, rimwe nerimwe richivakira pane rekare kuti rivandudze kuchengetedzeka kwesoftware uye kujeka kwayo muhupenyu hwayo hwese.
Heino pfupiso pfupi yemazinga mana:
- Danho 1: Kuvimbika Kwepakutanga - Inovimbisa kuti zvinhu zvinogadzirwa otomatiki uye nzvimbo dzinodzorwa, zvichiisa hwaro hwekutevedzana kwezvinyorwa.
- Danho rechipiri: Kubva - Inoteedzera mavambo ezvigadzirwa zvesoftware, ichiita shuwa kuti zvinogona kuteverwa kubva kwazvakabva.
- Danho rechitatu: Kuchengetedzwa - Inoshandisa zvidzoreso zvekupinda uye zvinogadziriswa kuti ione kana paine kukanganiswa.
- Danho rechina: Kuchengetedzwa Kwakanyanya – Inopa dziviriro yepamusoro-soro ine dziviriro isingakanganiswe, inogadziriswa nemhepo uye ine mitemo yakasimba yekudzora kubuda kwemvura.
Nei SLSA Yakakosha Kwazvo CI/CD Pipelines
Sezvo DevOps ichiita uye CI/CD pipelineZvinokurumidzisa kugadzirwa kwesoftware, zvinoburitsawo zvikanganiso. Varwisi vanogona kushandisa mipata iyi, vachiisa kodhi yakaipa kana kukanganisa zvinotendwa. Matanho eKugovera Zvinhu Zvitsva zveSoftware inogadzirisa matambudziko aya nekuona kuti nhanho yega yega yekuvandudza yakachengeteka, yakajeka, uye inosimbiswa.
- Kuonekwa uye KuteverwaSLSA inoteedzera shanduko dzese uye chikamu chiri muchikamu chako pipeline, zvichiita kuti zvive nyore kuona zvikanganiso nekukurumidza.
- Proactive Defense: Inoona uye inoderedza njodzi dzisati dzashandiswa.
- StandardizationSLSA inopa ruzivo rwakakosha standard kuchengetedza zvigadzirwa zvesoftware, kuve nechokwadi chekuti zvinoenderana mumabasa ese ekugadzira.
Maitiro eXygeni Anotsigira Kutevedzera SLSA
Kuzadzisa kutevedzera mitemo yeSLSA hakusi kungotarisa mabhokisi ekuchengetedza chete, asiwo kuchengetedza cheni yako yekupa software uku uchiramba uchigadzira nekukurumidza uye nekushanda zvakanaka. Kune zvikwata zveDevOps, kuenzana kwekuchengetedza nekumhanya kunogona kuve kwakaoma, kunyanya mukufamba nekukurumidza. CI/CD pipelines. Apa ndipo panopinda Xygeni, ichiita mabasa ekuchengetedza akakosha kuti ive nechokwadi chekuti cheni yako yekupa software inosangana uye inodarika hurongwa hweSLSA standards, pasina kunonotsa mafambiro ebasa rako.
1. Kugadzira Kuvimbika Kwekuvaka Otomatiki - SLSA Level 1
Danho rekutanga rekuchengetedza software ndeyekugara kwenguva refu. Xygeni inobatanidzwa mu CI/CD pipelines, kuita otomatiki kutarisa kuvaka uye kuona kuti kuvaka kwega kwega kunotevera maitiro anodzokororwa uye anosimbiswa. Nekubvisa zvikanganiso zvemaoko uye kuderedza njodzi dzekuchengetedza, Xygeni inobatsira zvikwata kusangana nekutevedzera kweSLSA framework Level 1 zviri nyore. Izvi zvinoreva kuti kubva pakutanga chaipo, kuvaka kwako kwakachengetedzwa uye kwakabatana ne zvakanakisisa zviito.
2. Kuve nechokwadi chekuti zvinhu zvirimo zviri kubva uye kuti zvinoteverwa zviri kubva kupi – SLSA Level 2
Kuziva kwakabva zvikamu zvesoftware yako kwakakosha pakuchengetedza. PaSLSA framework Level 2, Xygeni inoteedzera otomatiki mavambo echinhu chega chega, ichigadzira zvinyorwa zvisingachinjiki zvisingagone kuchinjwa. Nekuonekwa kwakazara musoftware yako. pipeline, zvikwata zvinogona kutsvaga chinhu chimwe nechimwe kubva kwachiri, zvichiita kuti zvive nyore kuona shanduko dzisina mvumo uye kudzivirira kurwiswa kwecheni yekugovera.
3. Kusimbisa Kudzora Kuchengetedzeka, SLSA Level 3
Sezvo njodzi dzekuchengetedza dzichiwedzera, dziviriro yakasimba inova yakakosha. PaSLSA framework Level 3, Xygeni inotanga zvidzoro zvekuchengetedza zvepamusoro, zvakaita sekutevera kuvimba panguva chaiyo uye kuongorora kugona kusvika. Panzvimbo pekuwedzera zviziviso zvemaawa akawanda, Xygeni inobvisa zvipingamupinyi zvisingashandisike, zvichibvumira vagadziri kuti vatarise njodzi chaidzo. Nekutarisa kuvimba kwakavakirwa mukati, zvikamu zvebato rechitatu zvinoongororwa zvakasimba zvekuchengetedza zvisati zvashandiswa.
4. Kuwana Kuchengetedzwa Kwakanyanya neHermetic Builds, SLSA Level 4
Pachikamu chechina cheSLSA, kuchengetedzeka kwesoftware kwasvika padanho repamusoro standard. Zvivakwa zvemukati, izvo zvinodzivirira kuvimba nezvinhu zvekunze, zvisina kusimbiswa, zvakakosha pakuona kuti chivakwa chega chega chakachengeteka uye hachikanganisike. Xygeni inozviitira otomatiki maitiro aya, ichiita shuwa kuti chinhu chega chega chinogadzirwa munzvimbo inodzorwa, yakaparadzana. Nekusimbisa nhanho yega yega yekuvaka, kunyora shanduko, uye kudzivirira shanduko dzisina mvumo, Xygeni inopa chivimbo chakazara mukuvimbika kwesoftware pasina kunonoka kukura.
NeXygeni, kuwana kutevedzera SLSA kuri nyore, kuri otomatiki, uye kwakabatanidzwa zvizere muhurongwa hwako CI/CD pipelines.
sei Xygeni Build Security Inosimbisa Zvipupuriro zveSLSA
Kuwana Mazinga Ekushandisa Zvinhu Zvekushandisa muSoftware Artifacts hakusi kungotarisa zvivakwa chete, kunoda kubva kwazvinoita, kusimbiswa, uye kusimbiswa kwekuchengetedzwa nguva dzose. Xygeni Build Security zvinorerutsa maitiro aya ne kugadzira chitupa otomatiki, kusimbiswa, uye manejimendi, zvichiita kuti zvive nyore kuve nechokwadi chekuti software yako yakasimba pasina kuwedzera basa kune vanogadzira.
Kugadzira Zvipupuriro Zvega
Kuvimba nesoftware kunotanga nemagwaro akasimba uye anosimbiswa. Xygeni's SALT (Software Attestations Layer for Trust) inogadzira otomatiki magwaro anoenderana neSLSA echivakwa chega chega, ichisimbisa kuvimbika kwayo uye ichitevera kwayakabva. Izvi zvinoita kuti danho rega rega rekuvaka rive rakanyorwa, risingakanganiswe, uye rakachengeteka.
Kusimbiswa Kuri Nyore & Kutarisirwa Kwepakati
Kugadzirisa zvipupuriro pane zvakawanda pipelinezvinogona kuva zvinorema. Xygeni, mapoka anogona kusimbisa zvitupa zviri nyore, achiva nechokwadi chekuti chikamu chega chega chesoftware chinoenderana nemitemo yekuchengetedza. Iyo Xygeni puratifomu inoisa pakati pekutarisira zvitupa, ichipa nzvimbo imwe chete yekutevera, kuongorora, uye kusimbisa kutevedzera Supply-chain Levels yeSoftware Artifacts uye NIST SP 800-204D standards.
Seamless CI/CD Kubatanidzwa Kwekugamuchirwa Nekukurumidza
Kuchengetedza kunofanira kushanda nevagadziri vemapurogiramu, kwete kuvarwisa. Xygeni SALT inobatanidzwa zvakanaka nezviripo. CI/CD pipelines, zvichipa mukana wekushandisa murairo (CLI) uye kuchengetedzeka otomatiki. Kunyangwe timu yako ichishandisa GitHub, GitLab, Jenkins, kana Azure DevOps, Xygeni inogonesa kusimbiswa kwechisimbiso panguva chaiyo, ichiva nechokwadi chekuti mavakirwo akachengeteka uye anosimbiswa zvizere munzvimbo dzese.
Kutevedzera Mutemo Kubva Kumagumo Kuenda Kumagumo Pasina Kukanganiswa
Xygeni inoita kuti kutevedzera SLSA kuve nyore nekuona kuti zvese zvigadzirwa zvesoftware zvinotsigirwa nezvipupuriro zvinogoneka kusimbiswa. Nekusimbiswa otomatiki, kuteverwa kwakazara kweprovenance, uye zvakadzama CI/CD kubatanidzwa, zvikwata zvinogona kusangana nekuchengetedzeka kwakanyanya standards pasina kunonoka kukura.
ne Xygeni Build Security, kuwana kutevedzera humbowo hweSLSA kuri nyore, kuri otomatiki, uye kwakazara mumabasa ako eDevSecOps.
Maitiro Akanakisisa Ekushandisa SLSA Framework
Kubatanidza Supply-chain Levels yeSoftware Artifacts framework mumabasa ako kunoda kuenzana nekuchengetedzwa nekushanda zvakanaka. Nekutanga vatori vechikamu vadiki, vanobatanidza, kushandisa otomatiki, uye kudzokorora zvichibva pamhinduro, unogona chengetedza cheni yako yekugovera software uku uchiramba uchigona kufamba zvakanaka. Heino nzira iyo Xygeni inotsigira nayo danho rega rega.
1. Ita Ongororo Yekutanga
Ongorora maitiro ako ekugadzira software uye ona mipata inoenderana nezvinodiwa neSLSA framework. Xygeni inobatsira kuronga zvinhu zvakakosha uye zvinoenderana nazvo. Inoona zvikanganiso uye inoratidza nzvimbo dzekuvandudza kuti isangane neSLSA. standards.
2. Bata Vanoda Kurumidza
Wana rutsigiro kubva kumapoka ekuvandudza, ekuchengetedza, uye ekushanda nekuratidza mabhenefiti ekubatanidzwa kweSLSA, akadai sekudzikira kwenjodzi dzekutengesa. Xygeni inopa mishumo yakajeka, zvichiita kuti zvive nyore kune vane chekuita nehurongwa kuti vatevere kufambira mberi uye vanzwisise kukosha kweSLSA.
3. Tanga Diki uye Chikero Zvishoma nezvishoma
Edzai chirongwa chekuyedza maitiro eSLSA padanho diki. Wedzerai mapurojekiti makuru sezvo timu yenyu yava kugadzikana. Zvishandiso zveXygeni zvinoita kuti zvive nyore kutanga uye kushandisa zvishoma nezvishoma maitiro eSLSA, kutanga nekuvaka otomatiki uye kutevedzera mavambo esoftware yenyu.
4. Batanidza Maitiro eSLSA muMabasa Aripo
Shandisa otomatiki kuisa maitiro eSLSA mumabasa ako CI/CD pipelines, kuderedza kushanda nesimba nemaoko uye kuona kuti zvinhu zvinoshanda nguva dzose. Xygeni inobatanidza zvakanyanya ne CI/CD pipelines, kuita mabasa ekuchengetedza otomatiki akadai sekutarisa kuvaka, kuongorora kuvimba, uye kugadzira kwakabva ruzivo.
5. Ipai Kudzidziswa uye Zvishandiso
Ita shuwa kuti zvikwata zvinonzwisisa zvizere zvinodiwa neSLSA kuburikidza nezvirongwa zvekudzidzisa uye magwaro akajeka. Xygeni inopa rutsigiro nekudzidziswa uye kubvumidzwa, ichipa ma interfaces ari nyore kushandisa uye mishumo yakadzama kuti zvive nyore kugadzirisa.
6. Ongorora uye Dzokorora Nguva Dzose
Gara uchiongorora kushanda kwemaitiro eSLSA uye gadzirisa zvichienderana nemhinduro. Mishumo yakadzama yeXygeni uye ongororo zvinokutendera kuti nguva zhinji tarisa uye gadzirisa maitiro ako ekuchengetedza.
7. Shandisa Zvishandiso zveSLSA Community
Bata nenharaunda yeSLSA kuti uwane nzira dzakanakisisa uye batsirawo kuti ugovane zvawakasangana nazvo. Xygeni inotsigira kutevedzera mitemo uye inobatsira sangano rako kuti rirambe rakabatana nemabasa akawanda ekuchengetedza.
8. Tarisa uye Usimbise Kutevedzera Mutemo
Shandisa nzira dzekutarisa nguva chaiyo uye nzira dzekuchengetedza otomatiki kuti uve nechokwadi chekuti SLSA inotevedzera mitemo nguva dzose. Xygeni inogara ichitarisa mitemo uye inotumira zviziviso otomatiki zvechero dambudziko, kunyanya muzvikamu zvevamwe. Kuchengetedza mitemo kwakabatanidzwa zvakananga muchikamu chako CI/CD pipeline.
Kuchengetedza Ramangwana Rako neXygeni neSLSA
Kuchengetedza ketani yako yekupa software haisisiri sarudzo, chinhu chinofanira kuitwa. Mugadziro weSLSA inokupa hurongwa hwakajeka hwekuchengetedza software yako, kubva pakuchengetedzwa kwekutanga kusvika kune nzira dzepamusoro dzisingakanganiswi. Xygeni, unogona kurerutsa kutevedzera mitemo uye kuwedzera matanho ako ekuchengetedza zviri nyore, uchichengetedza software yako yakachengeteka, yakasimba, uye yakagadzirira ramangwana.
Unoda kuchengetedza chain yako yekupa software here? Ona kuti Xygeni ingakubatsira sei kusangana neSupply-chain Levels yeSoftware Artifacts standardchengetedza masisitimu ako edhijitari nhasi.
Mibvunzo Inowanzo bvunzwa: Kunzwisisa SLSA Framework ye CI/CD Pipelines
Ko SLSA ndiyo yakanakisa here? Standard nokuti CI/CD Pipelines?
SLSA (Supply-chain Levels for Software Artifacts) ndeimwe yehurongwa hwekuchengetedza hwakakwana uye hwakagamuchirwa zvakanyanya kune CI/CD pipelines. Inopa nzira yakarongeka uye ine matanho ekuchengetedza kugadzirwa kwesoftware, ichitarisa pakuvaka kuvimbika, kubva kwayo, uye kuramba kutambwa kwayo.
Kunyange hazvo SLSA isiriyo yega standard, inoonekwa pachena nekuti:
- Inovhara hupenyu hwese hwesoftware, kubva pakusimba kwekodhi yekodhi kusvika pakuiswa kwayo.
- Inotsanangura mazinga ekuchengetedza akajeka (1-4), zvichiita kuti ikwanise kushandiswa zvinoenderana nezvinodiwa zvakasiyana zvekuchengetedza.
- Inoshanda pamwe chete nedzimwe nzira dzekuchengetedza dzakadai seNIST SP 800-204D neOWASP's CI/CD Njodzi dzekuchengetedza.
Kune masangano ari kutsvaga kusimbisa CI/CD kuchengetedzeka, SLSA isarudzo yakanaka kwazvo. Zvisinei, zvichienderana nezvinodiwa pakutevedzera mitemo, mamwe mapoka anogonawo kutevera NIST, CIS, kana hurongwa hwekuchengetedza hwakanangana neindasitiri pamwe chete neSLSA.
Ndiani Anotungamira SLSA Framework ye CI/CD Pipelines?
SLSA inotongwa ne OpenSSF (Open Source Security Foundation), chirongwa cheLinux Foundation chakatsaurirwa kuvandudza software supply chain security. OpenSSF inoshanda pamwe chete neGoogle, GitHub, Microsoft, nevamwe vatungamiriri veindasitiri kugadzira nekugadzirisa hurongwa hweSLSA.
Boka rinoshanda reSLSA rinoramba richivandudza hurongwa hwekugadzirisa njodzi dziri kubuda, kuenderana nemaitiro akanakisa, uye kuvandudza kushandiswa kwekuchengetedzwa mu CI/CD pipelines. Chero ani zvake anoda kupa kana kugara achiziva nezvekuvandudzwa kweSLSA anogona kushanda ne OpenSSF's nharaunda nemapoka ekushanda.
