Uhlaselo lweenkqubo zokubonelela ngesoftware lukhula ngesantya esingazange sibonwe ngaphambili. Ngokutsho kwe- SecurityWeek, ezi hlaselo zinyuke kakhulu 742% kwiminyaka emithathu edlulileyo, nto leyo ecacisa ukuba amanyathelo okhuseleko emveli awanele. Ukuphendula, Amanqanaba obonelelo lwezinto ezenziwe ngeSoftware (SLSA) isakhelo senziwe ukunceda imibutho ukuba iqinise iinkqubo zayo zophuhliso lwesoftware ukusuka ekuqaleni ukuya ekupheleni.
Yintoni i-SLSA Framework?
Umthombo: SLSA
I-SLSA Isikhokelo (Amanqanaba obonelelo lwezinto ezenziwe kwiSoftware), kuthiwa “salsa"U sisikhokelo sokhuseleko esibanzi esikhusela isoftware ukusuka ekuphuhlisweni ukuya ekusetyenzisweni kwayo. Sichaza amanqanaba amane okhuseleko, ngalinye lakha phezu kwelangaphambili ukuphucula ukhuseleko lwesoftware kunye nokungafihli nto kuyo yonke inkqubela yayo yobomi.
Nantsi ingcaciso emfutshane yamanqanaba amane:
- Inqanaba 1: Ukunyaniseka Okusisiseko – Iqinisekisa ukwakhiwa okuzenzakalelayo kunye neendawo ezilawulwayo, ibeka isiseko sokulandelelana.
- Inqanaba lesi-2: Imvelaphi – Ilandelela imvelaphi yezinto ezisetyenzisiweyo zesoftware, iqinisekisa ukuba zinokulandelelwa zibuyele kwimvelaphi yazo.
- Inqanaba lesi-3: Ukhuseleko – Isebenzisa ulawulo lokufikelela kunye nolwakhiwo oluphinda lusetyenziswe ukuze kubonwe ukuphazamiseka.
- Inqanaba lesi-4: Ukhuseleko oluphezulu – Ibonelela ngokhuseleko oluphezulu ngokukhusela izinto ezingaphazanyiswayo, ulwakhiwo olungenamoya kunye nolawulo oluqinileyo lwemvelaphi.
Kutheni i-SLSA ibalulekile kwi CI/CD Pipelines
Njengoko iDevOps isebenza kwaye CI/CD pipelineUkukhawulezisa uphuhliso lwesoftware, kukwaveza ubuthathaka. Abahlaseli banokusebenzisa ezi zikhewu, bafake ikhowudi enobungozi okanye baphazamise ukuxhomekeka. Amanqanaba obonelelo lwezinto ezenziwe kwiSoftware ijongana nale mingeni ngokuqinisekisa ukuba inyathelo ngalinye lenkqubo yophuhliso likhuselekile, licacile, kwaye liyaqinisekiswa.
- Ukubonakala kunye nokulandeleka: I-SLSA ilandelela lonke utshintsho kunye nenxalenye ekwi-akhawunti yakho. pipeline, nto leyo eyenza kube lula ukubona ubuthathaka kwangethuba.
- Ukhuseleko olusebenzayo: Ichonga kwaye inciphise iingozi ngaphambi kokuba zisetyenziswe.
- Standardukwenziwa: I-SLSA ibonelela ngenkonzo eyaziwayo standard ukukhusela izinto zakudala zesoftware, ukuqinisekisa ukuhambelana kuzo zonke iinkqubo zophuhliso.
Indlela iXygeni exhasa ngayo ukuthobela imithetho ye-SLSA
Ukufezekisa ukuthobela i-SLSA akupheleli nje ekujongeni iibhokisi zokhuseleko, kukwamalunga nokukhusela uthotho lwakho lokubonelela ngesoftware ngelixa ugcina uphuhliso lukhawuleza kwaye lusebenza kakuhle. Kumaqela e-DevOps, ukulinganisela ukhuseleko kunye nesantya kunokuba ngumceli mngeni, ngakumbi kwiindawo ezihamba ngokukhawuleza. CI/CD pipelines. Kulapho iXygeni ingena khona, izenzela imisebenzi ebalulekileyo yokhuseleko ukuqinisekisa ukuba uthotho lwakho lobonelelo lwesoftware luyahlangabezana kwaye ludlula isakhelo se-SLSA. standards, ngaphandle kokucothisa isantya somsebenzi wakho.
1. Ukuzenzekela Ukwakha Intembeko – SLSA Level 1
Inyathelo lokuqala lokukhusela isoftware kukuhambelana. I-Xygeni idityaniswa CI/CD pipelines, ukujongwa kwesakhiwo ngokuzenzekelayo kunye nokuqinisekisa ukuba isakhiwo ngasinye silandela inkqubo ephindaphindwayo nengqinisisekayo. Ngokususa iimpazamo ezenziwe ngesandla kunye nokunciphisa iingozi zokhuseleko, iXygeni inceda amaqela ukuba ahlangabezane nokuthobela umgaqo-nkqubo we-SLSA weNqanaba loku-1 ngokulula. Oku kuthetha ukuba kwasekuqaleni, izakhiwo zakho zikhuselekile kwaye zihambelana izinto ezilungileyo.
2. Ukuqinisekisa ukuvela kunye nokulandeleka – i-SLSA Level 2
Ukwazi apho izinto zakho zesoftware zivela khona kubalulekile kukhuseleko. Kwinqanaba lesi-2 lesakhelo se-SLSA, i-Xygeni ilandelela ngokuzenzekelayo imvelaphi yazo zonke izinto ezenziweyo, idala iirekhodi ezingaguqukiyo ezingenakutshintshwa. Ngokubonakala ngokupheleleyo kwisoftware yakho. pipeline, amaqela anokulandelela yonke into ukusuka kwimvelaphi yayo, nto leyo eyenza kube lula ukubona utshintsho olungagunyaziswanga kunye nokuthintela ukuhlaselwa kwekhonkco lokubonelela.
3. Ukuqinisa uLawulo loKhuseleko, i-SLSA Level 3
Njengoko izoyikiso zokhuseleko zikhula, ukhuseleko oluqinileyo luyafuneka. Kwinqanaba lesi-3 lesakhelo se-SLSA, i-Xygeni yazisa ulawulo lokhuseleko oluphambili, olufana nokulandelela ukuxhomekeka ngexesha langempela kunye nohlalutyo lokufikeleleka. Endaweni yokulayisha amaqela amaninzi ngezilumkiso, i-Xygeni ihluza ubuthathaka obungenakuxhaphazwa, ivumela abaphuhlisi ukuba bagxile kwiingozi zokwenyani. Ngokuhlolwa kokuxhomekeka okwakhelwe ngaphakathi, izinto zomntu wesithathu ziphononongwa ngokungqongqo kokhuseleko ngaphambi kokuba zisetyenziswe.
4. Ukufikelela kuKhuseleko oluPhezulu ngeeHermetic Builds, iSLSA Level 4
Kwinqanaba lesi-4 lesakhelo se-SLSA, ukhuseleko lwesoftware lufikelela kwinqanaba eliphezulu standard. Ulwakhiwo olungenazithintelo, oluthintela ukuxhomekeka kwizinto zangaphandle, ezingaqinisekiswanga, lubalulekile ekuqinisekiseni ukuba isakhiwo ngasinye sikhuselekile kwaye asiphazamiseki. I-Xygeni yenza le nkqubo ngokuzenzekelayo, iqinisekisa ukuba yonke into yenziwe kwindawo elawulwayo neyodwa. Ngokuqinisekisa inyathelo ngalinye lesakhiwo, ukubhala utshintsho, kunye nokuthintela utshintsho olungagunyaziswanga, i-Xygeni inika ukuzithemba okupheleleyo kwi-software ngaphandle kokucothisa uphuhliso.
NgeXygeni, ukufezekisa ukuthobela i-SLSA kulula, ngokuzenzekelayo, kwaye kudityaniswe ngokupheleleyo kwi-akhawunti yakho. CI/CD pipelines.
Njani Xygeni Build Security Yomeleza ubungqina be-SLSA
Ukufikelela kwiNqanaba leeNkonzo zoThengiso lweSoftware Artifacts akupheleli nje ekujongeni ulwakhiwo, kufuna imvelaphi, ukuqinisekiswa, kunye nokunyanzeliswa kokhuseleko okuqhubekayo. Xygeni Build Security yenza le nkqubo ibe lula ngokuthi ukuveliswa kwesiqinisekiso ngokuzenzekelayo, ukuqinisekiswa, kunye nolawulo, okwenza kube lula ukuqinisekisa ukuthembeka kwesoftware yakho ngaphandle kokongeza umsebenzi owongezelelweyo kubaphuhlisi.
Ukuvelisa Ubungqina Ngokuzenzekelayo
Ukuthemba isoftware kuqala ngeziqinisekiso eziqinileyo nezinokuqinisekiswa. I-SALT kaXygeni (iSoftware Attestations Layer for Trust) idala ngokuzenzekelayo iziqinisekiso ezihambelana ne-SLSA kwisakhiwo ngasinye, iqinisekisa ukuthembeka kwaso kwaye ilandelela imvelaphi yaso. Oku kuqinisekisa ukuba inyathelo ngalinye kwinkqubo yokwakha libhalwe phantsi, alinakuphazamiseka, kwaye likhuselekile.
Ukuqinisekiswa okulula kunye noLawulo oluPhakathi
Ukulawula ubungqina kwiindawo ezininzi pipelinekunokuba nzima kakhulu. I-Xygeni, amaqela anokuqinisekisa ubungqina ngokulula, eqinisekisa ukuba icandelo ngalinye lesoftware lihambelana nemigaqo-nkqubo yokhuseleko. Iqonga leXygeni libeka ulawulo lobungqina kwindawo enye, libonelela ngendawo enye yokulandelela, ukuphonononga, kunye nokunyanzelisa ukuthotyelwa kwamanqanaba obonelelo lwezinto zeSoftware kunye ne- I-NIST SP 800-204D standards.
Ngaphandle CI/CD Ukuhlanganiswa kokwamkelwa ngokukhawuleza
Ukhuseleko kufuneka lusebenzisane nabaphuhlisi, lungachasani nabo. I-Xygeni SALT idibana kakuhle ne-ekhoyo CI/CD pipelines, enika ukufikelela kumgca womyalelo (CLI) kunye nokunyanzeliswa kokhuseleko okuzenzakalelayo. Nokuba iqela lakho lisebenzisa iGitHub, iGitLab, iJenkins, okanye iAzure DevOps, iXygeni ivumela ukuqinisekiswa kobungqina bexesha langempela, iqinisekisa ukuba izakhiwo zikhuselekile kwaye zinokuqinisekiswa ngokupheleleyo kuyo yonke indawo.
Ukuthobela imiqathango ukususela ekuqaleni ukuya ekupheleni ngaphandle kokuphazamiseka
I-Xygeni yenza kube lula ukuthobela i-SLSA ngokuqinisekisa ukuba yonke into eyenziwe yisoftware ixhaswa ziziqinisekiso ezingqinisisekayo ze-cryptographic. Ngokuqinisekiswa okuzenzakalelayo, ukulandelwa kwemvelaphi epheleleyo, kunye nobunzulu CI/CD ukuhlanganiswa, amaqela anokufikelela kukhuseleko oluphezulu standardngaphandle kokucothisa uphuhliso.
kunye Xygeni Build Security, ukufezekisa ukuthobela ubungqina be-SLSA kulula, ngokuzenzekelayo, kwaye kufakwe ngokupheleleyo kwimisebenzi yakho ye-DevSecOps.
Iindlela ezilungileyo zokuphumeza i-SLSA Framework
Ukudibanisa ulwakhiwo lwe-Supply-chain Levels for Software Artifacts kwimisebenzi yakho kufuna ukulinganisela ukhuseleko kunye nokusebenza kakuhle. Ngokuqala abachaphazelekayo abancinci, ababandakanyekayo, ukusebenzisa i-automation, kunye nokuphindaphinda ngokusekelwe kwimpendulo, ungenza njalo. khusela uthotho lwakho lobonelelo lwesoftware ngelixa ugcina ubuchule. Nantsi indlela iXygeni exhasa ngayo inyathelo ngalinye.
1. Yenza uVavanyo lwangaphambili
Vavanya iinkqubo zakho zangoku zophuhliso lwesoftware kwaye uchonge izikhewu ezinxulumene neemfuno zesakhelo se-SLSA. I-Xygeni inceda ekudweliseni izinto ezibalulekileyo kunye nokuxhomekeka. Ichonga ubuthathaka kwaye iqaqambisa iindawo ekufuneka ziphuculwe ukuze kuhlangatyezwane ne-SLSA. standards.
2. Ukubandakanya abachaphazelekayo kwangethuba
Qinisekisa ukwamkelwa ngamaqela ophuhliso, okhuseleko, kunye nemisebenzi ngokubonisa iingenelo zokuhlanganiswa kwe-SLSA, ezifana nokunciphisa umngcipheko wokuhanjiswa kweenkonzo. I-Xygeni inika iingxelo ezicacileyo, nto leyo eyenza kube lula kubathathi-nxaxheba ukulandelela inkqubela phambili nokuqonda ixabiso le-SLSA.
3. Qala ngokuNcinci kwaye uQinise kancinci kancinci
Zama iprojekthi yokuvavanya iindlela zokusebenza ze-SLSA kwinqanaba elincinci. Yenza iprojekthi ezinkulu njengoko iqela lakho likhululeka ngakumbi. Izixhobo zeXygeni zenza kube lula ukuqala nokusebenzisa iindlela zokusebenza ze-SLSA kancinci kancinci, uqale ngokwakha ngokuzenzekelayo kwaye ulandelele imvelaphi yesoftware yakho.
4. Hlanganisa iiNkqubo ze-SLSA kwiindlela zokusebenza ezikhoyo
Sebenzisa okuzenzakalelayo ukufaka iinkqubo ze-SLSA kwikhompyutha yakho CI/CD pipelines, ukunciphisa umgudu owenziwa ngesandla nokuqinisekisa ukuhambelana. I-Xygeni idibana nzulu ne CI/CD pipelines, ukwenza imisebenzi yokhuseleko ngokuzenzekelayo efana nokubeka esweni ulwakhiwo, uhlalutyo lokuxhomekeka, kunye nokuveliswa kwemvelaphi.
5. Ukubonelela ngoQeqesho kunye neZixhobo
Qinisekisa ukuba amaqela ayaziqonda ngokupheleleyo iimfuno ze-SLSA ngokusebenzisa iinkqubo zoqeqesho kunye namaxwebhu acacileyo. I-Xygeni inika inkxaso ngoqeqesho kunye nokungeniswa, ibonelela ngeendawo zokunxibelelana ezisebenziseka lula kunye neengxelo ezineenkcukacha ukuze kube lula ukuziqhelanisa.
6. Hlaziya kwaye Uphinde Uhlaziye Rhoqo
Hlola rhoqo ukusebenza kakuhle kweenkqubo ze-SLSA kwaye uhlengahlengise ngokusekelwe kwingxelo. Iingxelo ezineenkcukacha zeXygeni kunye nohlalutyo zikuvumela ukuba rhoqo jonga kwaye ulungise amaqhinga akho okhuseleko.
7. Sebenzisa izixhobo zoLuntu ze-SLSA
Nxibelelana noluntu lwe-SLSA ukuze ufumane iindlela ezilungileyo zokuqhuba umsebenzi kwaye unikele kwakhona ukuze wabelane ngamava akho. I-Xygeni ixhasa ukuthobela imithetho kwaye inceda umbutho wakho uhlale unxibelelene nemizamo yokhuseleko ebanzi.
8. Ukubeka esweni nokuqinisekisa ukuthotyelwa kwemithetho
Sebenzisa iindlela zokubeka esweni ngexesha langempela kunye neendlela zokuqinisekisa ukuthotyelwa kwemithetho ngokuzenzekelayo ukuqinisekisa ukuthotyelwa kwemithetho rhoqo ne-SLSA. I-Xygeni isoloko ibeka esweni ukuthotyelwa kwemithetho kwaye ithumela izilumkiso ngokuzenzekelayo kuyo nayiphi na i-faulty, ingakumbi kumacandelo eqela lesithathu. Ukunyanzeliswa kokhuseleko kudityaniswe ngqo kwi-akhawunti yakho. CI/CD pipeline.
Ukukhusela Ikamva Lakho ngeXygeni kunye neSLSA
Ukukhusela uthungelwano lwakho lwesoftware akusekho khetho, yinto ebalulekileyo. Isakhelo se-SLSA ikunika isicwangciso esicacileyo sokukhusela isoftware yakho, ukusuka kukhuseleko olusisiseko ukuya kwiindlela eziphambili zokukhusela ukuphazamiseka. I-Xygeni, ungenza kube lula ukuthobela imithetho kwaye ukhulise amanyathelo akho okhuseleko ngokulula, ugcine isoftware yakho ikhuselekile, yomelele, kwaye ilungele ikamva.
Ngaba ufuna ukukhusela uthotho lwakho lwesoftware? Jonga indlela iXygeni enokukunceda ngayo uhlangabezane namaNqanaba eSupply-chain kwiSoftware Artifacts standardkwaye ukhusele iinkqubo zakho zedijithali namhlanje.
Imibuzo Ebuzwa Rhoqo: Ukuqonda iSakhelo se-SLSA se CI/CD Pipelines
Ngaba i-SLSA yeyona ilungileyo? Standard kuba CI/CD Pipelines?
I-SLSA (Amanqanaba oNcedo lweeNkqubo zeSoftware) yenye yezona nkqubo zokhuseleko zibanzi nezisetyenziswa kakhulu CI/CD pipelineIbonelela ngendlela ecwangcisiweyo nenemigangatho yokukhusela uphuhliso lwesoftware, igxile ekwakheni ukuthembeka, imvelaphi, kunye nokumelana nokuphazanyiswa.
Nangona i-SLSA ingeyiyo yodwa standard, iyabonakala kuba:
- Igubungela lonke umjikelo wobomi besoftware, ukusuka ekugqibeleleni kwekhowudi yomthombo ukuya ekusetyenzisweni kwayo.
- Ichaza amanqanaba okhuseleko acacileyo (1-4), okwenza ukuba ikwazi ukulungelelaniswa neemfuno zokhuseleko ezahlukeneyo.
- Isebenza kunye nezinye iindlela zokhuseleko ezifana ne-NIST SP 800-204D kunye ne-OWASP's CI/CD Iingozi zoKhuseleko.
Kwimibutho ejonge ukuqinisa CI/CD ukhuseleko, i-SLSA lukhetho oluhle kakhulu. Nangona kunjalo, ngokuxhomekeke kwiimfuno ezithile zokuthobela umthetho, amanye amaqela anokulandela i-NIST, CIS, okanye izikhokelo zokhuseleko eziphathelele ishishini kunye ne-SLSA.
Ngubani oLawula iSakhelo se-SLSA CI/CD Pipelines?
I-SLSA ilawulwa yi OpenSSF (Open Source Security iSiseko), iprojekthi yeSiseko seLinux ezinikele ekuphuculeni software supply chain security. OpenSSF Isebenzisana ngokusondeleyo neGoogle, iGitHub, iMicrosoft, kunye nezinye iinkokheli zoshishino ukuphuhlisa nokuphucula isakhelo se-SLSA.
Iqela elisebenzayo le-SLSA lihlala lihlaziya umgaqo-nkqubo ukuze lijongane nezisongelo ezivelayo, lihambelane neendlela ezilungileyo zokusebenza, kwaye liphucule ukwamkelwa kokhuseleko CI/CD pipelineNabani na onomdla wokufaka isandla okanye ukuhlala enolwazi malunga nophuhliso lwe-SLSA unokuzibandakanya OpenSSFuluntu kunye namaqela okusebenza.
