Isoftware namhlanje iqokelelwe kwiindawo ezininzi ezivulelekileyo kunye nezamaqela esithathu. Njengoko isidingo sokuthembana, ukubonakala, kunye nolawulo sikhula kulo lonke uthotho lonikezelo, i-OWASP SBOM standard I-CycloneDX ivele njengenye yezona zixhobo zibalulekileyo kwi-AppSec yanamhlanje kunye I-DevSecOpsXa isetyenziswa, iCycloneDX SBOM ibonelela ngokusobala ngokupheleleyo—ukusuka kwisoftware kunye neenkonzo ukuya kwiimodeli zokufunda koomatshini kunye nezixhobo zehardware.
Oku akusiyonto nje ikhethekileyo—yincwadi epheleleyo yezinto ezikunika ulwazi olungenakuthelekiswa nanto malunga noko kungaphakathi kwisoftware yakho. Isiseko se-OWASP, iCycloneDX ngoku yi-ECMA-424 esemthethweni standard, exhaswa luluntu lwehlabathi oluphilayo kwaye lwakhiwe ukunciphisa umngcipheko ngomlinganiselo omkhulu.
Yintoni iCycloneDX?
Eyona nto iphambili kuyo, iCycloneDX yiSoftware Bill of Materials elula neyanamhlanje (SBOM) ifomathi eyakhelwe ukhuseleko, ukuzenzekela, kunye nemisebenzi ye-DevSecOps yehlabathi lokwenyani. Ikwasisiseko se-OWASP SBOM standard—iyamkelwa kwihlabathi liphela kwaye ngoku isemthethweni njenge ECMA-424.
I-CycloneDX inceda amaqela ukuba abhale phantsi yonke into ekwisoftware yawo—ukusuka kwiipakeji kunye neenkonzo ezivulelekileyo ukuya kwiimodeli ze-ML, ii-cryptographic assets, kwanehardware. Ngamanye amazwi, ikunika uluhlu olupheleleyo lwento yonke oyithumelayo.
Ngaphezu koko, iCycloneDX ihlukile ngokunikezela:
- Ukuzenzekelayo okuphezulu kunye nokungashukumi CI/CD ukudityaniswa
- Iifomathi ezininzi: ii-JSON, i-XML, kunye nee-Protocol Buffers
- Inkxaso SBOM, SaaSBOM, ML-BOM, CBOM, kunye nokunye
- Izandiso ezakhelwe ngaphakathi ezifana ne-VEX, i-CDXA, kunye neengxelo
Ngenxa yoko, idlula ngaphaya kokulandelela ukuxhomekeka okusisiseko. I-CycloneDX ivumela ulawulo lomngcipheko olusebenzayo, impendulo yobuthathaka, kunye nokuthobela imithetho—konke oku kukwifomathi abaphuhlisi abafuna ukusebenza nayo.
Umzekelo weCycloneDX SBOM (Isiqendu seJSON):
Kutheni iCycloneDX SBOM Ibalulekile kumaqela eDevSecOps
Ukuba uthumela ikhowudi, usengozini yokuthumela. I-CycloneDX yenza loo ngozi ibonakale.
NgeCycloneDX SBOMs, unga:
- Chonga ukuxhomekeka okuphelelwe lixesha okanye okubuthathaka
- Qonda iimbopheleleko zelayisenisi
- Fumanisa iingozi eziguqukayo kwangethuba
- Lungelelanisa neefreyimu ezifana ne-SSDF, I-DORA, yaye I-NIS2
- Xhasa ukuqinisekiswa kobunyani bexesha lokusebenza kunye nokuthobela imithetho njengekhowudi
Kufuphi: ufumana "ilebhile yesondlo" yesoftware yakho—ngokuzenzekelayo nangokuchanekileyo.
Indlela yokusebenzisa iCycloneDX SBOM Kuyo yonke iNkqubo yoBomi beSoftware
I-CycloneDX SBOM ayisiyonto nje oyivelisayo—yinto oyisebenzisayo. Enyanisweni, nokuba ujonga ubuthathaka okanye ulungelelanisa ukuthobela imithetho, nantsi indlela iCycloneDX ezisa ngayo ixabiso lokwenyani kulo lonke ixesha lesoftware:
Ulawulo Lokungakwazi Ukuzikhusela Olusebenzela Abavelisi
Okokuqala, chonga iingozi kwangethuba usebenzisa standard izihlonzi (i-CPE, i-PURL, i-SWID) ezidibana ne SCA okanye izikena ezizimeleyo.
Emva koko, jonga ngobuchule nge-VEX (Vulnerability Exploitability eXchange) ukuze ubonise ukuba zeziphi ii-CVE ezisebenzayo kwindawo yakho.
Lungisa ngokukhawuleza usebenzisa i-precise, idatha ephinda ivele—ICycloneDX inceda iqela lakho ukuba lingene kwindawo efanelekileyo ngaphandle kokubuyela umva nokubuya.
Okokugqibela, tyhila ubuthathaka ngokunoxanduva ngenkxaso eyakhelwe ngaphakathi ye-VDRs (Vulnerability Disclosure Reports) ehambelana ne-ISO standards.
Ilungele amaqela okhuseleko, abathengisi beemveliso, kunye neendawo eziqinisekisa ukuba izinto zisebenza kakuhle.
I-Supply Chain Trust, Intembeko kunye neNyaniso
Qinisekisa ukuthembeka kwecandelo usebenzisa i-cryptographic hashes, uqinisekise ukuba ii-component azizange ziphazanyiswe.
Ukuze wongeze olunye ungqimba lokuthembana, sayina SBOMs usebenzisa i-JSF okanye i-XMLsig ukuqinisekisa imvelaphi kunye nobunyani.
Ngaphezu koko, landela umkhondo wemvelaphi kunye nemvelaphi ukuze ubone utshintsho olungagunyaziswanga okanye olungagunyaziswanga—isitshixo sokugcina ukuthembana kumaqela asasazwe kunye neziseko zekhowudi zomntu wesithathu.
Ilungele ukukhusela ulwakhiwo pipelines, ukubonisa ukuthembana, okanye ukuvumelana ne-secure SDLC standards.
Uluhlu Yonke into—iSoftware, iiNkonzo, iiModeli ze-AI, iHardware
Bamba uluhlu olupheleleyo lwe-stack yakho—ukusuka kwiilayibrari zekhowudi kunye nee-API ukuya kwiimodeli ze-ML kunye nezixhobo ezifakwe ngaphakathi.
Ukongeza, gcina ukubonakala kwezinto ze-cryptographic ezifana nezitshixo kunye neesatifikethi, uqinisekise ukuba akukho nto idlulayo.
Yakhelwe amaqela alawula ii-stacks ezintsonkothileyo, iinkqubo zakudala, okanye iindawo ezilawulwayo.
Ulawulo lweeLayisensi kunye noLawulo lwe-IP
Yenza iitshekhi zelayisensi ezivulelekileyo zenzeke ngokuzenzekelayo usebenzisa i-SPDX metadata ngqo ngaphakathi kwiCycloneDX OWASP yakho SBOM.
Landelela iilayisenisi zorhwebo kunye namalungelo okusebenzisa idatha ukuze uhlale uthobela imithetho ngexesha lophicotho-zincwadi kunye nomjikelo wokuthenga.
Ilungele iingcali zobunjineli, amaqela ezomthetho, kunye naye nabani na olawula imigaqo-nkqubo ye-OSS.
Iigrafu zokuxhomekeka kunye noyilo lwenkqubo
Makisha zombini ukuxhomekeka ngokuthe ngqo kunye nokuguqukayo ngokucacileyo.
Qonda indlela iinkonzo kunye nezinto ezisebenzisana ngayo ngaphakathi koyilo lwakho—ukunceda amaqela anciphise ubunzima, alawule umngcipheko, kwaye aphucule ukusebenza.
Ifanelekile kwi-AppSec, i-DevOps, kunye nabayili beenkqubo ngokufanayo.
Ukuthobela kunye noBungqina obuzenzekelayo
Xhasa ukuthotyelwa kwemigaqo efana I-DORA, I-SSDF, yaye I-NIS2 usebenzisa iCycloneDX Attestations (CDXA).
Thumela iingxelo ezifundeka ngomatshini ngaphandle, kwaye uhlele ubungqina ngaphambi kokuhlolwa kweencwadi—hayi emva koko.
Uloyiso olukhulu CISOs, abaphathi bokuthobela imithetho, kunye namaqela alawulwayo.
Kaloku, iCycloneDX ayisiyofomathi nje kuphela—sisikhawuleziso somsebenzi. Kwaye ngeXygeni, awuvele nje uvelise. SBOMs—uyazisebenzisa, ngaphakathi kwakho pipeline.
Indlela yokwenza iCycloneDX SBOM kwiSekhondi
NgeXygeni, ivelisa iCycloneDX SBOM iyakhawuleza, ayikhuphisani, kwaye izenzekela ngokupheleleyo. Ungaqala ngomyalelo olula we-CLI okanye, ukuba ukhetha, sebenzisa iWebUI enobuhlobo. Nokuba yeyiphi na indlela, idibana ngqo kwi-akhawunti yakho. CI/CD pipeline kwaye inika ixesha langempela, umgangatho wemveliso SBOMs—ngaphandle komzamo owongezelelweyo ofunekayo.
Ukongeza, iXygeni ityebisa SBOM imveliso enokuqonda okunzulu kokhuseleko, okwenza ukuba ibe ngaphezu nje koluhlu olungaguqukiyo lwezixhobo.
Izakhono eziphambili:
- Ivelisa ngokuzenzekelayo SBOMngexesha lokwakha
- Ixhasa iifomathi zeCycloneDX kunye ne-SPDX
- Yongeza ukufikelela, amanqaku e-EPSS, kunye nengqiqo yokuxhaphaka
- Ifaka ii-VDR (iiNgxelo zokuDalula ukuVuleka) kunye ne-VEX ukuze kuhlolwe imeko
- Ixhasa ukusayina okungenazikhiye kunye nokuhlolwa kobunyani bezinto ezenziwe ngezinto
Iingcinga Zokugqibela: Ukwenza iCycloneDX SBOMUmsebenzi Wakho
Kwihlabathi apho isoftware idityaniswe khona, ingakhiwanga ukusuka ekuqaleni, ukubonakala akunyanzelekanga—kusisiseko. Yiyo loo nto standardnjenge-OWASP SBOM, ngakumbi iinkcukacha zeCycloneDX, ziya zibaluleke kakhulu kumaqela obunjineli, okhuseleko, kunye nokuthobela imithetho.
Nokuba ufuna ukuphucula ulawulo lobuthathaka, uvumelane ne-DORA okanye i-NIS2, okanye ufumane ukuzithemba kwinto oyithumelayo, i-CycloneDX SBOM inika ukucaca kunye nolwakhiwo olufunekayo kumaqela akho.
Kwaye ngeXygeni, yonke into evela SBOM Ukunika amanqaku ukusuka kwisizukulwana ukuya kwisizukulwana kunye nokulungiswa kwexesha langempela kuyazenzekela—ukuguqula i-software yakho yezinto ezisetyenzisiweyo ibe yi-asethi ephilayo, kungekuphela nje ifayile engaguqukiyo.
👉 Ukulungele ukuyibona isebenza? Bhukisha idemo yakho yeXygeni namhlanje.
TL;DR - Ikhowudi Enobungozi Ingabangela Njani Umonakalo?
- CycloneDX = I-OWASP SBOM standard (ECMA-424) isetyenziselwa ukucwangcisa idatha yokhuseleko, ilayisenisi, kunye necandelo
- CycloneDX SBOM = Ifayile okanye into esetyenzisiweyo elandela i-CycloneDX spec—i-software yakho yokwenyani yezinto ezisetyenzisiweyo
- I-OWASP SBOM = Inkqubo ethembekileyo yezixhobo, iifomathi, kunye nesikhokelo esakhelwe kwiCycloneDX yeDevSecOps yanamhlanje
- I-Xygeni = Eyona ndlela ikhawulezayo yokwenza, ukutyebisa, kunye nokwenza into kwiCycloneDX SBOMs—ezenzekelayo, ehambelanayo, kunye CI/CD-ulungile
