Ukuqinisa uKhuseleko lweSoftware kwixesha lokuhlaselwa kweTyathanga loNikezelo #
Ukunyuka kwe uhlaselo lwenkqubo yokubonelela ngesoftware wenze ukhuseleko CI/CD pipelines kwaye izixhobo zesoftware kubaluleke kakhulu kunangaphambili. Yintoni i-SLSA? The Amanqanaba obonelelo lwezinto ezenziwe kwiSoftware Isikhokelo inikezela indlela ecwangcisiweyo yokhuseleko lwesoftware, Ukuqinisekisa ukuthembeka kwezinto zakudala kulo lonke umjikelo wophuhliso. Inxalenye ephambili yesi sikhokelo yile SLSA Provenance, eqinisekisa phi, nini, kwaye njani isoftware yakhiwe, ithintela ukuphazamisana kunye notshintsho olungagunyaziswanga. Ngokwamkela iindlela zokhuseleko ze-Supply-chain Levels for Software Artifacts, imibutho inokukwazi ukuqinisa uthotho lwabo lobonelelo lwesoftware kwaye wakhe ukuthemba inkqubo yabo yophuhliso..
Ingcaciso:
Yintoni i-SLSA? #
Amanqanaba e-Supply-chain for Software Artifacts (SLSA) sisakhelo sokhuseleko esenzelwe ukukhusela amakhonkco okubonelela ngesoftware kwimingcipheko. Siqinisekisa ukwakhiwa nokusasazwa kwesoftware okukhuselekileyo, sikhokela imibutho ukusuka kwi-automation esisiseko ukuya kwiinkqubo ezilandelekayo ngokupheleleyo nezingenakuphazamiseka.
Yintoni i SLSA Provenance? #
SLSA Provenance yirekhodi eneenkcukacha zeendawo, ixesha, kunye nendlela isoftware eyakhiwe ngayo. Iqinisekisa ukuthembeka kwezinto zakudala, ibonelela ngokubonakala ngokupheleleyo kwiinxalenye zesoftware kunye nokuxhomekeka kwayo. SLSA Provenance, imibutho inokuthintela ukuphazamisana, iqinisekise ukuthembana, kwaye igcine ulawulo olupheleleyo kwikhonkco labo lokubonelela ngesoftware.
Imvelaphi ye SLSA Provenance #
Isakhelo se-Supply-chain Levels for Software Artifacts saphuhliswa ukuze sijongane nokukhula kweengxaki zokuhanjiswa kwesoftware. IiSolarWinds kunye neCodeCov ubuthathaka obuveziweyo kwindlela isoftware eyakhiwe, eqinisekiswa, nesasazwa ngayo. Ngenxa yoko, I-Google yenze i-SLSA, besebenzisa iindlela zabo zokhuseleko lwangaphakathi, ukunceda imibutho ikhusele CI/CD pipelineizinto zesoftware kunye nezinto ezisetyenzisiweyo.
Namhlanje, amanqanaba e-Supply-chain for Software Artifacts alawulwa yi OpenSSF (Open Source Security Isiseko) phantsi Linux FoundationIbonelela ngendlela ecacileyo, inyathelo ngenyathelo yokuphucula ukuthembeka kwesoftware, ukhuseleko lwezinto ezenziweyo, kunye nokulandelela imvelaphi. Ngokungafaniyo neenkqubo zokhuseleko lwe-cyber ezifana ne-NIST okanye CIS I-SLSA igxile ngokukodwa kukhuseleko lophuhliso lwesoftware, iqinisekisa ukuba ulwakhiwo alunakuphazamiseka kwaye luyaqinisekiswa.
Ngokusebenzisa SLSA Provenance, imibutho inokulandelela yonke into enxulumene nomjikelo wobomi besoftware yayo. Oku kuqinisekisa ukuba akukho nto icacileyo, ukhuseleko, kunye nokuthotyelwa kwemithetho, kunciphisa umngcipheko wotshintsho olungagunyaziswanga kunye nokuphazamiseka kwekhonkco lokubonelela.
Iingcamango eziphambili zamanqanaba obonelelo lwezinto ezisetyenzisiweyo kwiSoftware Artifacts #
Amanqanaba e-SLSA acacisiwe #
| Inqanaba le-SLSA | Oko Ikuqinisekisayo | IiNzuzo zoKhuseleko |
|---|---|---|
| Nqanaba 1 | Ukwakhiwa okuzenzakalelayo | Inciphisa iimpazamo zabantu kunye nokuphazamiseka ngengozi |
| Nqanaba 2 | Ukuqinisekiswa komthombo + ulawulo oluqinileyo | Iqinisekisa ukuthembeka kwekhowudi kunye nokwakhiwa okuthembekileyo |
| Nqanaba 3 | SLSA Provenance efunekayo | Ibonelela ngeerekhodi ezineenkcukacha zendlela kunye nendawo izinto zakudala ezakhiwe ngayo |
| Nqanaba 4 | Izakhiwo eziphinda ziphindeke kwakhona ezinemvelaphi epheleleyo | Iqinisekisa izinto zakudala ezingenakuphazanyiswa kunye nokhuseleko oluphezulu lwekhonkco lokubonelela |
Amanqanaba e-Supply-chain yeSoftware athelekiswa njani nezinye iiNkqubo zoKhuseleko? #
Isakhelo soKhuseleko lweIntanethi se-SLSA vs. NIST: #
Gxi ninisaI-NIST inika isikhokelo esibanzi sokhuseleko lwe-cyber kodwa ayijolisi kakhulu ekuqinisekiseni uthungelwano lwesoftware.
uncedo: Amanqanaba e-Supply-chain yeSoftware agxile ngakumbi ekukhuseleni ukuthembeka kwesoftware kwaye anika amanyathelo acacileyo okukhusela izinto zakudala zesoftware nge SLSA Provenance, okongeza indlela ebanzi ye-NIST.
Amanqanaba e-SLSA-chain vs. Imodeli yoBuchule boQinisekiso lweSoftware ye-OWASP (SAMM): #
Gxi ninisa: I-OWASP SAMM inceda ekudaleni amaqhinga okhuseleko kwiiprojekthi zesoftware.
uncedo: Amanqanaba e-Supply-chain yeSoftware angena nzulu kukhuseleko lwe-supply chain. Igxila kwimvelaphi kunye nokuphindaphinda, ngelixa i-SAMM igubungela ukhuseleko ngokubanzi. SLSA Provenance iqinisekisa ukhuseleko kunye nobunyani bezinto ezisetyenzisiweyo zesoftware.
Amanqanaba obonelelo ngeenkonzo vs. CIS Ulawulo: #
Gxi ninisa: CIS Ulawulo lunika izikhokelo zokukhusela iinkqubo ze-IT kodwa alujolisi kuphuhliso lwesoftware okanye kwizinto zakudala.
uncedo: Amanqanaba e-Supply-chain yeSoftware anika amanyathelo acacileyo okukhusela ukwakhiwa kwesoftware, kusetyenziswa Amanqanaba obonelelo lwezinto ezenziwe kwiSoftware Isakhelo sokuqinisekisa ukuba isakhiwo ngasinye sikhuselekile kwaye asiphazanyiswa.
Kutheni Ufanele Ukhethe Amanqanaba Obonelelo lweSoftware Kunamanye? #
Kukho iindlela ezininzi zokhuseleko, kodwa amanqanaba eSupply-chain for Software ahlukile ngokugxila kwi-software supply chain. Inika amanyathelo alula ukuwalandela ukuphucula ukuthembeka kwesoftware kunye nemvelaphi yayo, okwenza ibe lukhetho oluqinileyo kunye neendlela zokhuseleko ezibanzi.
- Ukugxila kwiCandelo loNikezelo: Amanqanaba eeNgxowa-mali zeSoftware ayilwe ngokukodwa ukukhusela iikhonkco zobonelelo lwesoftware, enika isikhokelo esicacileyo malunga nokuthembeka kwezinto zakudala kunye SLSA Provenance.
- Amanqanaba oQinisekiso: Amanqanaba ahlukeneyo avumela imibutho ukuba iphucule ukhuseleko inyathelo ngenyathelo, nto leyo enika indlela ecacileyo yokuphucula okuqhubekayo.
- Ukunyaniseka kwezinto ezenziweyo: Le nkqubo igxininisa ukuphinda-phinda kunye nemvelaphi, iqinisekisa ukhuseleko lwesoftware ngeendlela ezinye iinkqubo ezingayenziyo.
- Ukugqitywa okubanziNgokukhusela isoftware ukusuka kwikhowudi ukuya kwi-artifact, iiNqanaba zeSupply-chain zeSoftware zibonelela ngokhuseleko olupheleleyo lwe-supply chain, ukuqinisekisa ukwakhiwa okungenakuphazanyiswa kunye SLSA Provenance.
- OluNcedisayoAmanqanaba e-Supply-chain yeSoftware asebenza kakuhle ne-frameworks ezifana ne-NIST okanye CIS Ulawulo, ukuphucula ukhuseleko ngokubanzi ngokujongana nobuthathaka beenkqubo zobonelelo lwesoftware.
Ukukhusela ikamva nge-SLSA yeSoftware kunye neXygeni #
Ngoku ekubeni usazi ukuba yintoni i-slsa, masithethe ngayo I-XygeniI-Xygeni inceda imibutho ukuba iphumeze kwaye igcine ukuthobela amanqanaba e-Supply-chain yeSoftware kuwo onke amanqanaba. Iqonga lethu lihambelana nobunzima balo standards, okwenza ukuhlanganiswa kokhuseleko kulo lonke ixesha lesoftware yakho kube lula. Ukusuka ekuzenzekeleni ukwakha ukuya ekuqinisekiseni ukuba akukho monakalo SLSA Provenance ilawula, iXygeni iqinisa ukhuseleko lwesoftware kwaye yenza kube lula ukuthobela imithetho.
ngokusebenzisa SLSA Provenance, I-Xygeni iqinisekisa ukuba imvelaphi yesoftware nganye kunye nenkqubo yokwakha iyaqinisekiswa. Oku kuthintela utshintsho olungagunyaziswanga okanye ukuphazamisa kwaye kubonelela ngokubonakala ngokupheleleyo kwikhonkco lakho lokubonelela ngesoftware. Ngenxa yoko, umbutho wakho uba namandla ngakumbi kwiingozi eziguqukayo. Ngokusebenzisana ne-Xygeni, ungahamba ngokuzithemba amanqanaba eNqanaba leNgxowa-mali yeSoftware, uqinisekise ikamva apho ikhonkco lakho lokubonelela ngesoftware likhuselekile. I-Xygeni ikhusela ulwakhiwo, iqinisekisa ukuthembeka kwezixhobo nge SLSA Provenance, kwaye ibonelela ngesisombululo esibanzi sokhuseleko lwesoftware yanamhlanje.
Imibuzo ebuzwa qho #
I-SLSA (Amanqanaba oNcedo lweeNdawo zoBugcisa kwiSoftware) sisakhelo esiphucula software supply chain security ngokuthintela ukuphazamisa nokuqinisekisa ukuthembeka kwezinto zakudala ngokusebenzisa SLSA Provenance. Kubaluleke kakhulu CI/CD pipelines njengoko iseka isiseko sokhuseleko kuyo yonke inkqubo yokwakha nokusasaza isoftware.
I-SLSA ivelele njengenye yezona zibalaseleyo standards zokukhusela CI/CD pipelineIbonelela ngezikhokelo ezipheleleyo zokuqinisekisa inyathelo ngalinye le pipeline—ukusuka kulawulo lwekhowudi yomthombo ukuya ekuhanjisweni kwezinto zakudala—ngokuthintela ukuphazamisa kunye nokufikelela okungagunyaziswanga. SLSA Provenance iqinisekisa kwaye iqinisekisa ukuthembeka kwezinto zakudala kuyo yonke inkqubo.
Ekuqaleni iGoogle yaphuhlisa isakhelo se-SLSA, kwaye OpenSSF (Open Source Security Foundation) ngoku iyilawula. Le ntlangano ikhuthaza iindlela ezilungileyo zokukhusela uthungelwano lobonelelo lwesoftware kwaye iphucula rhoqo ulwakhiwo ukuze ihlangabezane neemfuno ezintsha zokhuseleko.
Ukuqonda ukuba yintoni i-SLSA akuphelelanga ngaphandle kokwazi iingxaki ezisombulula. Iinkqubo zokubonelela ngesoftware zisengozini yokuphazamiseka, ukuhlaselwa kokuxhomekeka, kunye neenkqubo zokwakha ezingakhuselekanga. SLSA Provenance Isombulula ezi ngokuqinisekisa ukuba yonke into eyenziwe kwisoftware iyalandeleka, iyaqinisekiswa, kwaye ayiphazanyiswa. Izisa ukucaca kunye nokuthembakala CI/CD pipelines, okwenza ukhuseleko lube yinto ezenzekelayo, kungekhona into ecingelwa emva koko.
