Ho Matlafatsa Tšireletso ea Software Mehleng ea Litlhaselo tsa Ketane ea Phepelo #
Ho phahama ho litlhaselo tsa ketane ea phepelo ea software e entse ho sireletsa CI/CD pipelines 'me lisebelisoa tsa software bohlokoa ho feta leha e le neng pele. SLSA ke eng? The Maemo a ketane ea phepelo bakeng sa lisebelisoa tsa maiketsetso tsa software Mookameli e fana ka mokhoa o hlophisitsoeng oa ts'ireletso ea software, netefatsa botšepehi ba lintho tsa khale ho pholletsa le potoloho ea bophelo ba nts'etsopele. Karolo ea bohlokoa ea moralo ona ke SLSA Provenance, e netefatsang hokae, neng, le joang software e hahiloe, e thibela ho senyeha le diphetoho tse sa dumellwang. Ka ho amohela Maemo a Phepelo bakeng sa mekgwa ya tshireletso ya Software Artifacts, mekgatlo e ka matlafatsa ketane ea bona ea phepelo ea software le ho aha tšepa ts'ebetso ea bona ea nts'etsopele..
Litlhaloso:
SLSA ke eng? #
Maemo a Phepelo bakeng sa Lisebelisoa tsa Software (SLSA) ke moralo oa ts'ireletso o etselitsoeng ho sireletsa liketane tsa phepelo ea software litšokelong. O netefatsa ho hahoa le ho ajoa ha software ka mokhoa o sireletsehileng, o tataisa mekhatlo ho tloha ho iketsahalla ha motheo ho ea lits'ebetsong tse ka lateloang ka botlalo le tse sa sitisoeng ke letho.
ke eng SLSA Provenance? #
SLSA Provenance ke rekoto e qaqileng ea hore na software e hahiloe hokae, neng, le joang. E netefatsa botšepehi ba lintho tsa khale, e fana ka ponahalo e felletseng likarolong tsa software le lintho tse itšetlehileng ka tsona. SLSA Provenance, mekhatlo e ka thibela ho sitisoa, ea netefatsa tšepo, 'me ea boloka taolo e felletseng holim'a ketane ea eona ea phepelo ea software.
Tšimoloho ea SLSA Provenance #
Moralo oa Maemo a Phepelo bakeng sa Lisebelisoa tsa Software o ntlafalitsoe ho sebetsana le litšokelo tse ntseng li hola tsa ketane ea phepelo ea software. SolarWinds le CodeCov bofokodi bo pepesitseng mabapi le kamoo software e hahuoang, e netefatswang le ho ajoa kateng. Ka lebaka leo, Google e thehile SLSA, e sebelisa mekhoa ea eona ea ts'ireletso ea kahare, ho thusa mekhatlo ho sireletsa CI/CD pipelinelisebelisoa tsa software le tsa khale.
Kajeno, Maemo a Phepelo bakeng sa Lisebelisoa tsa Software a laoloa ke OpenSSF (Open Source Security Mokhatlo) tlase ho Linux Foundation. E fana ka mokhoa o hlakileng, oa mohato ka mohato oa ho ntlafatsa botšepehi ba software, tšireletso ea lintho tsa khale, le ho latela tšimoloho ea eona. Ho fapana le meralo e akaretsang ea ts'ireletso ea inthanete joalo ka NIST kapa CIS Ka taolo, SLSA e shebane haholo le tshireletso ya ntshetsopele ya software, e netefatsa hore dikaho ha di sitiswe ke ho kenngwa tshebetsong ha software mme di ka netefatswa.
Ka ho sebelisa SLSA Provenance, mekhatlo e ka latela karolo e 'ngoe le e 'ngoe ea potoloho ea bophelo ba software ea bona. Sena se netefatsa pepeneneng, ts'ireletso le ho latela melao, ho fokotsa kotsi ea liphetoho tse sa lumelloang le litšitiso tsa ketane ea phepelo.
Mehopolo ea Bohlokoa ea Maemo a Phepelo bakeng sa Lisebelisoa tsa Software #
Maemo a SLSA a Hlalositsoe #
| Boemo ba SLSA | Seo E se Tiisitseng | Melemo ea Tšireletso |
|---|---|---|
| Lekala la 1 | Meaho e iketsang | E fokotsa liphoso tsa batho le ho senya ka phoso |
| Lekala la 2 | Netefatso ea mohloli + litsamaiso tse matla | E netefatsa botšepehi ba khoutu le meaho e tšepahalang |
| Lekala la 3 | SLSA Provenance hlokehang | E fana ka direkoto tse qaqileng tsa hore na mesebetsi ea matsoho e hahiloe joang le hokae |
| Lekala la 4 | Meaho e ka ikatisang hape e nang le tšimoloho e felletseng | E netefatsa lintho tsa khale tse ke keng tsa senyeha le tshireletso e phahameng ka ho fetisisa ea ketane ea phepelo |
Maemo a Phepelo bakeng sa Software a Bapisoa Joang le Meralo e Meng ea Tšireletso? #
Moralo oa Ts'ireletso ea Inthanete oa SLSA khahlanong le NIST: #
lebiseng tlhokomelo mefutengNIST e fana ka tataiso e pharaletseng bakeng sa tshireletso ya inthanete ka kakaretso empa ha e tsepamise maikutlo haholo ho sireletseng diketane tsa phepelo ya software.
sebelisa hamolemo libaka tseo: Maemo a Phepelo bakeng sa Software a shebane haholo le ho sireletsa botšepehi ba software mme a fana ka mehato e hlakileng ea ho sireletsa lisebelisoa tsa software ka SLSA Provenance, e tlatsang mokhoa o pharaletseng oa NIST.
Maemo a SLSA-chain khahlanong le OWASP Software Assurance Maturity Model (SAMM): #
lebiseng tlhokomelo mefuteng: OWASP SAMM e thusa ho theha maano a tshireletso bakeng sa merero ya software.
sebelisa hamolemo libaka tseo: Maemo a Phepelo bakeng sa Software a teba ka botebo tshireletsong ya ketane ya phepelo. E shebane le tlhaho le ho ikatisa hape, ha SAMM e akaretsa tshireletso e akaretsang. SLSA Provenance e netefatsa polokeho le bonnete ba lisebelisoa tsa software.
Maemo a ketane ea phepelo khahlanong le CIS e tla laola: #
lebiseng tlhokomelo mefuteng: CIS Taolo e fana ka tataiso bakeng sa ho sireletsa litsamaiso tsa IT empa ha e tsepamise maikutlo ntlafatsong ea software kapa lintho tsa khale.
sebelisa hamolemo libaka tseo: Maemo a Phepelo bakeng sa Software a fana ka mehato e hlakileng ea ho sireletsa meralo ea software, ho sebelisoa Maemo a ketane ea phepelo bakeng sa lisebelisoa tsa maiketsetso tsa software Moralo oa ho netefatsa hore moaho o mong le o mong o sireletsehile ebile ha o na litšitiso.
Hobaneng o lokela ho kgetha Maemo a Phepelo bakeng sa Software ho feta a mang? #
Ho na le meralo e mengata ea ts'ireletso, empa Maemo a Phepelo bakeng sa Software a hlahella ka ho tsepamisa maikutlo ho ketane ea phepelo ea software. E fana ka mehato e bonolo ho e latela ho ntlafatsa botšepehi ba software le tšimoloho ea eona, e leng se etsang hore e be khetho e matla hammoho le meralo e pharaletseng ea ts'ireletso.
- Tsepamiso ea Ketane ea Phepelo: Maemo a Phepelo bakeng sa Software a etselitsoe ka ho khetheha ho sireletsa liketane tsa phepelo ea software, a fana ka tataiso e hlakileng mabapi le botšepehi ba lintho tsa khale le SLSA Provenance.
- Maemo a TiisetsoMaemo a maemo a dumella mekgatlo ho ntlafatsa tshireletso kgato ka kgato, e leng se fanang ka tsela e hlakileng bakeng sa ntlafatso e tswelang pele.
- Botšepehi ba Maiketsetso: Moralo ona o totobatsa ho ikatisa hape le ho hlaha ha ona, ho netefatsa tshireletso ya software ka ditsela tseo meralo e meng e sa e etseng.
- Tlatsetso e felletseng: Ka ho sireletsa software ho tloha khoutung ho ea ho ea ho lintho tsa khale, Maemo a Phepelo bakeng sa Software a fana ka tšireletso e felletseng ea ketane ea phepelo, a netefatsang hore e hahuoa ka mokhoa o sa sitisoeng ke letho. SLSA Provenance.
- Ho tlatsetsaMaemo a Phepelo bakeng sa Software a sebetsa hantle ka meralo e kang NIST kapa CIS E laola, e ntlafatsa tshireletso ka kakaretso ka ho sebetsana le bofokodi ba ketane ea phepelo ea software.
Ho Sireletsa Bokamoso ka SLSA bakeng sa Software le Xygeni #
Jwale kaha o se o tseba hore na slsa ke eng, ha re bueng ka XygeniXygeni e thusa mekhatlo ho kenya tshebetsong le ho boloka ho latela Maemo a Phepelo bakeng sa Software maemong ohle. Sethala sa rona se tsamaisana le maemo a sona a thata standards, ho etsa hore kopanyo ea ts'ireletso ho pholletsa le potoloho ea bophelo ba software ea hau e be bonolo. Ho tloha ho iketsetsa lihaho ho isa ho qobelloeng ha ho sitisoa ke litšitiso SLSA Provenance e laola, Xygeni e matlafatsa tshireletso ya software mme e nolofatsa ho latela melao.
A sebelisa SLSA Provenance, Xygeni e netefatsa hore tšimoloho le ts'ebetso ea kaho ea software e 'ngoe le e 'ngoe ea lintho tsa khale lia netefatsoa. Sena se thibela liphetoho tse sa lumelloang kapa ho sitisoa 'me se fana ka ponahalo e felletseng ka har'a ketane ea hau ea phepelo ea software. Ka lebaka leo, mokhatlo oa hau o ba le botsitso haholoanyane litšokelong tse ntseng li fetoha. Ka ho sebelisana le Xygeni, u ka tsamaea ka kholiseho maemong a Maemo a Ketane ea Phepelo bakeng sa Software, ho netefatsa bokamoso moo liketane tsa hau tsa phepelo ea software li sireletsehileng. Xygeni e sireletsa meaho, e tiisa botšepehi ba lintho tsa khale ka SLSA Provenance, mme e fana ka tharollo e felletseng bakeng sa tshireletso ya software ya sejwalejwale.
Lipotso Asked hangata #
SLSA (Maemo a Phepelo bakeng sa Lintho tsa Khatiso tsa Software) ke moralo o ntlafatsang software supply chain security ka ho thibela ho senyeha le ho netefatsa botšepehi ba lintho tsa khale ka SLSA Provenance. Ho bohlokoa ho CI/CD pipelines kaha e theha motheo oa ts'ireletso ho pholletsa le lits'ebetso tsa kaho le kabo ea software.
SLSA e hlahella e le e 'ngoe ea tse ntle ka ho fetisisa standardbakeng sa ho tiisa CI/CD pipelines. E fana ka litataiso tse felletseng ho sireletsa mohato o mong le o mong oa pipeline—ho tloha taolong ya khoutu ya mohlodi ho isa ho tlisweng ha dintho tsa maiketsetso—ka ho thibela ho kenngwa tshebetsong le phihlello e sa dumellwang. SLSA Provenance e netefatsa le ho netefatsa botšepehi ba lintho tsa khale nakong eohle ea ts'ebetso.
Qalong Google e ile ea theha moralo oa SLSA, 'me OpenSSF (Open Source Security Foundation) jwale ke yona e e laolang. Mokgatlo ona o kgothaletsa mekgwa e metle ya ho sireletsa diketane tsa phepelo ya software mme o ntlafatsa moralo ka mehla ho fihlela ditlhoko tse ntjha tsa tshireletso.
Ho utloisisa hore na SLSA ke eng ha hoa fella ntle le ho tseba mathata ao e a rarollang. Liketane tsa phepelo ea software li kotsing ea ho sitisoa, litlhaselo tsa ho itšetleha ka tsona, le lits'ebetso tsa kaho tse sa sireletsehang. SLSA Provenance e rarolla tsena ka ho netefatsa hore software e 'ngoe le e 'ngoe ea khale e ka latelwa, ea netefatsoa, le hore ha e senyehe. E tlisa pepeneneng le tšepo ho CI/CD pipelines, ho etsa hore ts'ireletso e be ntho e sa reroang, eseng ntho e tlang ka morao.
