Ukuhlaselwa kwe-software supply chain kuyanda ngesivinini esingakaze sibonwe. Ngokusho kuka- I-SecurityWeek, lokhu kuhlasela kuye kwanda ngo 742% eminyakeni emithathu edlule, okwenza kucace ukuthi izinyathelo zokuphepha zendabuko azisanele. Ukuphendula, i- Amazinga Ochungechunge Lokuphakelwa Kwezinto Zokwenziwa Zesofthiwe (SLSA) uhlaka lwakhiwe ukusiza izinhlangano ukuqinisa izinqubo zazo zokuthuthukisa isofthiwe kusukela ekugcineni kuya ekugcineni.
Iyini i-SLSA Framework?
Umthombo: SLSA
I-SLSA Framework (Amazinga ochungechunge lokuhlinzeka ngezinto zobuciko zesofthiwe), okubizwa ngokuthi “salsa" luhlaka oluphelele lokuphepha oluvikela isofthiwe ekuthuthukisweni nasekusetshenzisweni kwayo. Luchaza amazinga amane okuphepha, ngalinye lakhela kwelangaphambilini ukuthuthukisa ukuphepha kwesofthiwe kanye nokucaca kuyo yonke impilo yayo.
Nasi isifinyezo esifushane samazinga amane:
- Izinga 1: Ubuqotho Obuyisisekelo – Iqinisekisa ukwakheka okuzenzakalelayo kanye nezindawo ezilawulwayo, ibeka isisekelo sokulandelela.
- Izinga 2: Imvelaphi – Ilandelela imvelaphi yezinto ezisetshenziswayo zesofthiwe, iqinisekise ukuthi zingalandelelwa zibuyele emthonjeni wazo.
- Izinga 3: Ukuphepha – Isebenzisa izilawuli zokufinyelela kanye nokwakhiwa okuphindaphindwayo ukuze ibone ukuphazamiseka.
- Izinga 4: Ukuphepha Okuphezulu – Ihlinzeka ngezinga eliphezulu lokuvikelwa ngokuvikela ukuphazanyiswa, ukwakheka okungangenisi umoya kanye nokulawulwa okuqinile kwemvelaphi.
Kungani i-SLSA ibaluleke kakhulu CI/CD Pipelines
Njengoba i-DevOps iqhuba futhi CI/CD pipelineUma zisheshisa ukuthuthukiswa kwesofthiwe, zidalula nobuthakathaka. Abahlaseli bangasebenzisa lezi zikhala, bafake ikhodi enonya noma baphazamise ukuncika. Amazinga Ochungechunge Lokunikezela Ngezinto Zokusebenza Zesofthiwe ibhekana nalezi zinselele ngokuqinisekisa ukuthi isinyathelo ngasinye senqubo yokuthuthukisa siphephile, sisobala, futhi siyaqinisekiswa.
- Ukubonakala Nokulandelela: I-SLSA ilandelela yonke inguquko kanye nengxenye esenzweni sakho pipeline, okwenza kube lula ukubona ubuthakathaka kusenesikhathi.
- Ukuzivikela Okusebenzayo: Ikhomba futhi inciphise izingozi ngaphambi kokuba zisetshenziswe kabi.
- Standardukwenziwa: I-SLSA inikeza i- standard ukuze kuqinisekiswe izinto zobuciko zesofthiwe, kuqinisekiswe ukuthi aziguquguquki kuzo zonke izinqubo zokuthuthukisa.
Indlela i-Xygeni Esekela Ngayo Ukuthobela Imithetho ye-SLSA
Ukufeza ukuthobela imithetho ye-SLSA akukhona nje ukuhlola amabhokisi okuphepha, kumayelana nokuvikela uchungechunge lwakho lokuhlinzekwa kwesofthiwe ngenkathi kugcinwa intuthuko ishesha futhi isebenza kahle. Kumaqembu e-DevOps, ukulinganisela ukuphepha kanye nesivinini kungaba yinselele, ikakhulukazi ezindaweni ezihamba ngokushesha CI/CD pipelines. Yilapho i-Xygeni ingena khona, yenza imisebenzi ebalulekile yokuphepha ngokuzenzakalelayo ukuqinisekisa ukuthi uchungechunge lwakho lokuhlinzekwa kwesofthiwe luhlangabezana futhi ludlula uhlaka lwe-SLSA. standards, ngaphandle kokunciphisa ijubane lomsebenzi wakho.
1. Ukwakha Ubuqotho Okuzenzakalelayo – Izinga 1 le-SLSA
Isinyathelo sokuqala sokuvikela isofthiwe ukungaguquguquki. I-Xygeni ihlangana CI/CD pipelines, ukwenza ngokuzenzakalelayo ukuqapha ukwakhiwa nokuqinisekisa ukuthi ukwakhiwa ngakunye kulandela inqubo ephindaphindwayo neqinisekiswayo. Ngokususa amaphutha enziwe ngesandla nokunciphisa izingozi zokuphepha, i-Xygeni isiza amaqembu ukuthi ahlangabezane nokuhambisana nohlaka lwe-SLSA Level 1 kalula. Lokhu kusho ukuthi kusukela ekuqaleni, ukwakhiwa kwakho kuvikelwa futhi kuhambisana imikhuba engcono kakhulu.
2. Ukuqinisekisa Ukuvela Nokulandelela – Izinga lesi-2 le-SLSA
Ukwazi ukuthi izingxenye zesofthiwe yakho zivelaphi kubalulekile ekuphepheni. Ku-SLSA framework Level 2, i-Xygeni ilandelela ngokuzenzakalelayo imvelaphi yazo zonke izinto ezidaliwe, idale amarekhodi angaguquki angenakushintshwa. Ngokubonakala okugcwele kusofthiwe yakho. pipeline, amaqembu angalandelela yonke into emuva emthonjeni wayo, okwenza kube lula ukubona izinguquko ezingagunyaziwe nokuvimbela ukuhlaselwa kweketanga lokuphakelwa.
3. Ukuqinisa Izilawuli Zokuphepha, Izinga lesi-3 le-SLSA
Njengoba izinsongo zokuphepha zikhula, kudingeka ukuvikelwa okuqinile. Ku-SLSA framework Level 3, i-Xygeni yethula izilawuli zokuphepha ezithuthukisiwe, njengokulandelela ukuthembela ngesikhathi sangempela kanye nokuhlaziywa kokufinyeleleka. Esikhundleni sokulayisha ngokweqile amaqembu ngezaziso, i-Xygeni ihlunga ubuthakathaka obungenakuxhashazwa, ivumela onjiniyela ukuthi bagxile ezingozini zangempela. Ngokuhlolwa kokuthembela okwakhelwe ngaphakathi, izingxenye zenkampani yangaphandle zihlolwa ngokuqinile ngaphambi kokuba zisetshenziswe.
4. Ukufinyelela Ukuphepha Okuphezulu Ngezakhiwo Eziqinile, i-SLSA Level 4
Kuhlaka lwe-SLSA Level 4, ukuphepha kwesofthiwe kufinyelela ezingeni eliphezulu kakhulu standard. Ukwakhiwa kwe-hermetic, okuvimbela ukuthembela ekuthembekeni kwangaphandle, okungaqinisekisiwe, kuyisihluthulelo sokuqinisekisa ukuthi ukwakhiwa ngakunye kuphephile futhi akuphazamiseki. I-Xygeni yenza le nqubo ibe ngokuzenzakalelayo, iqinisekisa ukuthi yonke into eyenziwe yenziwe endaweni elawulwayo nehlukanisiwe. Ngokuqinisekisa isinyathelo ngasinye sokwakhiwa, ukubhala izinguquko, nokuvimbela ukuguqulwa okungagunyaziwe, i-Xygeni inikeza ukuzethemba okugcwele ekuqineni kwesofthiwe ngaphandle kokunciphisa intuthuko.
Nge-Xygeni, ukufeza ukuthobela imithetho ye-SLSA kulula, ngokuzenzakalela, futhi kuhlanganiswe ngokugcwele ne-akhawunti yakho. CI/CD pipelines.
Kanjani Xygeni Build Security Kuqinisa Ubufakazi be-SLSA
Ukufinyelela amazinga ochungechunge lokuhlinzekwa kokuhambisana ne-Software Artifacts akukhona nje ukuqapha izakhiwo, kudinga ukuvela, ukuqinisekiswa, kanye nokuqiniswa kokuphepha okuqhubekayo. Xygeni Build Security kwenza le nqubo ibe lula ngokuthi ukukhiqizwa kobufakazi okuzenzakalelayo, ukuqinisekiswa, kanye nokuphathwa, okwenza kube lula ukuqinisekisa ubuqotho besofthiwe yakho ngaphandle kokwengeza umsebenzi owengeziwe kubathuthukisi.
Ukukhiqiza Ubufakazi Ngokuzenzakalelayo
Ukuthembela kusofthiwe kuqala ngeziqiniseko eziqinile neziqinisekisiwe. I-SALT (Software Attestations Layer for Trust) ye-Xygeni idala ngokuzenzakalelayo iziqiniseko ezihambisana ne-SLSA zesakhiwo ngasinye, iqinisekisa ubuqotho baso futhi ilandelela umsuka waso. Lokhu kuqinisekisa ukuthi isinyathelo ngasinye enkambisweni yokwakha sibhaliwe phansi, asiphazamiseki, futhi siphephile.
Ukuqinisekiswa Okulula Nokuphathwa Okuhlanganisiwe
Ukuphatha ubufakazi kuzo zonke eziningi pipelinekungaba nzima kakhulu. Nge I-Xygeni, amaqembu angaqinisekisa ubufakazi kalula, eqinisekisa ukuthi ingxenye ngayinye yesofthiwe ihambisana nezinqubomgomo zokuphepha. Ipulatifomu ye-Xygeni ihlanganisa ukuphathwa kobufakazi, ihlinzeka ngendawo eyodwa yokulandelela, ukuhlola, kanye nokuphoqelela ukuhambisana namazinga okunikezela ngezinto zokwenziwa zesofthiwe kanye I-NIST SP 800-204D standards.
I-seamless CI/CD Ukuhlanganiswa Kokwamukelwa Okusheshayo
Ezokuphepha kufanele zisebenzisane nabathuthukisi, hhayi ngokumelene nabo. I-Xygeni SALT ihlangana kahle ne-ekhona CI/CD pipelines, enikeza ukufinyeleleka komugqa womyalo (i-CLI) kanye nokuphoqelelwa kokuphepha okuzenzakalelayo. Kungakhathaliseki ukuthi ithimba lakho lisebenzisa i-GitHub, i-GitLab, i-Jenkins, noma i-Azure DevOps, i-Xygeni ivumela ukuqinisekiswa kobufakazi besikhathi sangempela, iqinisekisa ukuthi izakhiwo ziphephile futhi zingaqinisekiswa ngokugcwele kuyo yonke indawo.
Ukuthobela Imithetho Kusukela Ekugcineni Kuya Ekugcineni Ngaphandle Kokuphazamiseka
I-Xygeni yenza ukuthobela imithetho ye-SLSA kube lula ngokuqinisekisa ukuthi yonke into eyenziwe ngesofthiwe isekelwa ubufakazi obungaqinisekiswa nge-cryptographic. Ngokuqinisekiswa okuzenzakalelayo, ukulandelela okugcwele okuvela kuyo, kanye nokujulile CI/CD ukuhlanganiswa, amaqembu angahlangabezana nokuvikeleka okuphezulu kakhulu standardngaphandle kokunciphisa intuthuko.
With Xygeni Build Security, ukufeza ukuhambisana nobufakazi be-SLSA kulula, ngokuzenzakalela, futhi kufakwe ngokugcwele emisebenzini yakho ye-DevSecOps.
Izindlela Ezinhle Zokusebenzisa Uhlaka lwe-SLSA
Ukuhlanganisa amazinga ochungechunge lokuhlinzekwa kwezinsizakalo zeSoftware Artifacts emisebenzini yakho yokusebenza kudinga ukulinganisela ukuphepha nokusebenza kahle. Ngokuqala abathintekayo abancane, ababandakanyayo, ukusebenzisa ukuzenzekela, kanye nokuphindaphinda ngokusekelwe empendulweni, ungakwazi vikela uchungechunge lwakho lokuhlinzekwa kwesofthiwe ngenkathi igcina ukuguquguquka. Nansi indlela i-Xygeni esekela ngayo isinyathelo ngasinye.
1. Yenza Ukuhlolwa Kwangaphambi Kokuqala
Hlola izinqubo zakho zamanje zokuthuthukisa isofthiwe bese uthola izikhala ezihambisana nezidingo zohlaka lwe-SLSA. I-Xygeni isiza ekuhleleni izimpahla ezibalulekile kanye nokuncika. Ithola ubuthakathaka futhi iqokomisa izindawo okufanele zithuthukiswe ukuze kuhlangatshezwane ne-SLSA standards.
2. Xhumana Nababambe iqhaza kusenesikhathi
Vikela ukusekelwa okuvela emaqenjini okuthuthukisa, ezokuphepha, kanye nokusebenza ngokubonisa izinzuzo zokuhlanganiswa kwe-SLSA, njengokunciphisa izingozi zochungechunge lokuphakelwa. I-Xygeni inikeza imibiko ecacile, okwenza kube lula ngababambiqhaza ukulandelela inqubekela phambili nokuqonda ukubaluleka kwe-SLSA.
3. Qala Kancane Kancane Kancane Kancane
Hlola iphrojekthi yokuhlola imikhuba ye-SLSA ngezinga elincane. Khulisa amaphrojekthi amakhulu njengoba ithimba lakho liba likhulu. Amathuluzi e-Xygeni enza kube lula ukuqala nokusebenzisa kancane kancane imikhuba ye-SLSA, kuqala ngokwakha okuzenzakalelayo nokulandelela imvelaphi yesofthiwe yakho.
4. Hlanganisa Imikhuba ye-SLSA Emigudwini Yomsebenzi Ekhona
Sebenzisa ukuzenzekela ukufaka imikhuba ye-SLSA emshinini wakho CI/CD pipelines, ukunciphisa umzamo owenziwa ngesandla nokuqinisekisa ukuhambisana. I-Xygeni ihlangana ngokujulile ne CI/CD pipelines, ukwenza imisebenzi yokuphepha ngokuzenzakalela njengokuqapha ukwakha, ukuhlaziywa kokuxhomekeka, kanye nokukhiqizwa kwemvelaphi.
5. Nikeza Ukuqeqeshwa Nezinsizakusebenza
Qinisekisa ukuthi amaqembu aqonda ngokugcwele izidingo ze-SLSA ngezinhlelo zokuqeqesha kanye nemibhalo ecacile. I-Xygeni inikeza ukwesekwa ngokuqeqeshwa kanye nokufakwa, ihlinzeka ngezixhumi ezisebenziseka kalula kanye nemibiko enemininingwane ukuze kube lula ukuzivumelanisa nezimo.
6. Buyekeza futhi Uphinde Ubuyekeze Njalo
Buyekeza njalo ukusebenza kahle kwemikhuba ye-SLSA bese ulungisa ngokusekelwe kumpendulo. Imibiko eningiliziwe kanye nokuhlaziywa kwe-Xygeni kukuvumela ukuthi njalo qapha futhi ulungise amasu akho okuphepha.
7. Sebenzisa Izinsiza Zomphakathi ze-SLSA
Xhumana nomphakathi we-SLSA ukuze uthole imikhuba emihle futhi unikele ukuze wabelane ngolwazi lwakho. I-Xygeni isekela ukuthobela imithetho futhi isiza inhlangano yakho ukuthi ihlale ixhumene nemizamo ebanzi yokuphepha.
8. Ukuqapha Nokuphoqelela Ukuthobela Imithetho
Sebenzisa izindlela zokuqapha ngesikhathi sangempela kanye nezindlela zokuphoqelela ezenzakalelayo ukuqinisekisa ukuthobela okuqhubekayo kwe-SLSA. I-Xygeni iqapha njalo ukuthobela imithetho futhi ithumela izaziso ezenzakalelayo nganoma yikuphi ukukhubazeka, ikakhulukazi ezingxenyeni zenkampani yangaphandle. Ukuphoqelela ezokuphepha kuhlanganiswe ngqo ku-akhawunti yakho. CI/CD pipeline.
Ukuvikela Ikusasa Lakho nge-Xygeni kanye ne-SLSA
Ukuvikela uchungechunge lwakho lokuhlinzekwa kwesofthiwe akuseyona inketho, kuyinto edingekayo. Uhlaka lwe-SLSA ikunikeza uhlelo olucacile lokuvikela isofthiwe yakho, kusukela ekuphepheni okuyisisekelo kuya ezindleleni ezithuthukisiwe ezingaphazamisi. I-Xygeni, ungenza kube lula ukuthobela imithetho futhi ukhulise izindlela zakho zokuphepha kalula, ugcine isofthiwe yakho iphephile, iqinile, futhi ilungele ikusasa.
Ufuna ukuvikela uchungechunge lwakho lokuhlinzeka ngesofthiwe? Bona ukuthi i-Xygeni ingakusiza kanjani ukuhlangabezana namazinga ochungechunge lokuhlinzeka ngezinto zesofthiwe standards futhi uvikele izinhlelo zakho zedijithali namuhla.
Imibuzo Evame Ukubuzwa: Ukuqonda Uhlaka lwe-SLSA lwe- CI/CD Pipelines
Ingabe i-SLSA ingcono kakhulu? Standard ngoba CI/CD Pipelines?
I-SLSA (Amazinga Okunikezela Ngezinhlelo Zokusebenza Zesofthiwe) ingenye yezinhlaka zokuphepha eziphelele kakhulu nezisetshenziswa kabanzi ze- CI/CD pipelines. Ihlinzeka ngendlela ehlelekile nenezigaba zokuqinisekisa ukuthuthukiswa kwesofthiwe, igxile ekwakheni ubuqotho, imvelaphi, kanye nokumelana nokuphazamiseka.
Nakuba i-SLSA akuyona yodwa standard, kuvelele ngoba:
- Ihlanganisa yonke imjikelezo yempilo yesofthiwe, kusukela ekuthembekeni kwekhodi yomthombo kuya ekusetshenzisweni kwayo.
- Ichaza amazinga okuphepha acacile (1-4), okwenza kube lula ukuzivumelanisa nezidingo zokuphepha ezahlukene.
- Isebenza kanye nezinye izinhlaka zokuphepha ezifana ne-NIST SP 800-204D kanye ne-OWASP's CI/CD Izingozi Zokuphepha.
Izinhlangano ezifuna ukuqinisa CI/CD ukuphepha, i-SLSA iyisinqumo esihle kakhulu. Kodwa-ke, kuye ngezidingo ezithile zokuthobela imithetho, amanye amaqembu angalandela ne-NIST, CIS, noma izinhlaka zokuphepha eziqondene nomkhakha kanye ne-SLSA.
Ubani Olawula Uhlaka lwe-SLSA lwe CI/CD Pipelines?
I-SLSA ilawulwa yi- OpenSSF (Open Source Security i-Linux Foundation), iphrojekthi ye-Linux Foundation ezinikele ekuthuthukiseni software supply chain security. OpenSSF Isebenzisana eduze ne-Google, i-GitHub, i-Microsoft, kanye nabanye abaholi bemboni ukuthuthukisa nokuthuthukisa uhlaka lwe-SLSA.
Iqembu elisebenzayo le-SLSA liqhubeka nokuvuselela uhlaka ukuze libhekane nezinsongo ezivelayo, lihambisane nemikhuba emihle, futhi lithuthukise ukusetshenziswa kwezokuphepha ku CI/CD pipelineNoma ubani onesifiso sokufaka isandla noma ukuhlala enolwazi ngentuthuko ye-SLSA angaxhumana OpenSSFumphakathi kanye namaqembu okusebenza.
