SBOMでソフトウェアを守れ！10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

Developers Summit 2022

Transcript

1. 4#0.Ͱιϑτ΢ΣΞΛकΕʂ
   ೥ޙ΋ࣗ৴Λ࣋ͬͯ
   ϦϦʔε͢ΔͨΊʹ
   ࠓ࢝ΊΔ%FW4FD0QT
   σϒαϛ
   

   View Slide

2. %FW4FD0QTͷηογϣϯɺ
   ଟ͍Ͱ͢Ͷʂ
   1
   

   View Slide

3. ͦΜͳத͓ӽ͠Լ͞Γ
   ͋Γ͕ͱ͏͍͟͝·͢
   2
   

   View Slide

4. Α͜ͳͰ͢
   3
   • +'SPHͷ%FWFMPQFS"EWPDBUF
   • %FW0QTΛ੝Γ্͍͛ͯ͘κ
   • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ
   4*FS ޿ࠂձࣾ ূ݊ελʔτΞοϓ
   • ઌिɺେਓʹͳͬͯॳͷˆΛܦݧ
   օ͞ΜҾ͖ଓ͖ࣗ͝Ѫ͍ͩ͘͞!
   !"#$$%&'
   (#)*+,%-.
   

   View Slide

5. ࠓճͷσϒαϛςʔϚ
   ʮ೥ޙ΋ੈքͰ௨͡ΔΤϯδχΞͰ͋ΔͨΊʹʯ
   4
   

   View Slide

6. ೥
   ͋ͬͱ͍͏͚ؒͩͲɺͨ͘͞Μͷ͜ͱ͕Ͱ͖Δ
   5
   ʙ೥લɺ೥લ͸ग़͖ͯͨͷʹ೥લ͚ͩग़ͯ͜ͳ͔ͬͨ(PPHMFQIPUPTʜ
   
   

   View Slide

7. ͜ͷηογϣϯ͸
   ೥ޙʹඋ͑ͯ
   ͍͔ʹ΋ͷͮ͘ΓΛ͢Δ͔
   Ͱ͸ͳ͘
   6
   

   View Slide

8. ͍͔ʹ΋ͷΛ҆શʹอ͔ͭɺ
   ҆શͳ΋ͷΛಧ͚Δ͔
   ͷώϯτΛ͓ಧ͚͠·͢
   7
   

   View Slide

9. %FW4FD0QTͱ͸
   •%FWͱ0QTʹՃ͑ͯɺ4FDVSJUZ΋
   ڠۀͯ͠ιϑτ΢ΣΞΛ࡞͍ͬͯ͘
   • શһ͕શ෦Λग़དྷΔΑ͏ʹͳΔ
   ඞཁ͸ͳ͍
   • ·ͣ͸ؙ౤͛͠ͳ͍ɺཧղ͢Δ
   • গ͓ͣͭ͠ޓ͍खΛ޿͛Δ
   8
   8
   ։ൃ ӡ༻
   ηΩϡ
   ϦςΟ
   

   View Slide

10. ηΩϡϦςΟͱ͍ͬͯ΋༷ʑ
    9
    • Πϯϑϥɺιϑτ΢ΣΞɺ
    ώϡʔϚϯΤϥʔͳͲؾʹ
    ͢΂͖͜ͱ͸ଟذʹΘͨΔ
    • %FW4FD0QTͷλʔήοτ͸
    ιϑτ΢ΣΞͷηΩϡϦ
    ςΟͰ͋Δ
    ग़యʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯ
    IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ
    

    View Slide

11. ιϑτ΢ΣΞͷηΩϡϦςΟʁ
    10
    10
    %%PT߈ܸ
    42-ΠϯδΣΫγϣϯ
    ϥϯαϜ΢ΣΞ ϑΟογϯά
    θϩσΠ߈ܸ
    ϒϧʔτϑΥʔεΞλοΫ
    

    View Slide

12. ιϑτ΢ΣΞͷηΩϡϦςΟʁ
    11
    11
    

    View Slide

13. ͦΜͳʹ୯७Ͱ͸ͳ͍
    12
    

    View Slide

14. αϓϥΠνΣʔϯ߈ܸ
    13
    

    View Slide

15. αϓϥΠνΣʔϯ߈ܸ
    • ιϑτ΢ΣΞʹෆਖ਼ͳϓϩάϥϜ΍όοΫυΞΛ࢓ࠐΈɺ
    ͦͷιϑτ΢ΣΞΛऔಘͨ͠૬खʹରͯ͠߈ܸΛߦ͏
    • ඪతΛ௚઀߈ܸͤͣɺ ଟ͘ͷ৔߹ɺΑΓηΩϡϦςΟ
    ରࡦ͕खബͳ
    ؔ࿈ձࣾ΍औҾઌΛૂͬͨ߈ܸΛߦ͏
    14
    

    View Slide

16. ࠷ۙͷࣄྫ
    15
    15
    ग़యɿ ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ
    IUUQTKBQBO[EOFUDPNBSUJDMF
    

    View Slide

17. ࠷ۙͷࣄྫ
    16
    16
    ग़యɿ +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱ
    IUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX
    

    View Slide

18. खͷಧ͘ൣғ͚ͩͷରࡦͰ͸଍Γͳ͍
    • ࣗ෼Ͱॻ͍ͨίʔυ͕҆શͰ΋ɺऔಘͯ͠࢖ͬͨιϑτ
    ΢ΣΞʹ੬ऑੑ͕ݟ͔ͭΔՄೳੑ͕͋Δ
    • ࡢࠓɺϓϩϓϥΠΤλϦͳιϑτ΢ΣΞͷʙׂఔ౓͕
    044ͱݴΘΕ͍ͯΔ
    17
    ग़యɿ 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯ
    IUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG
    ʮηΩϡϦςΟɾεΩϟϯʯ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$"
    ͱ͸ʁ
    IUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM
    ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯ
    IUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS
    

    View Slide

19. Կ͔͋ͬͨͱ͖ɺ
    ࣗ෼ͷιϑτ΢ΣΞ͕
    େৎ෉͔͙͢෼͔Γ·͔͢ʁ
    18
    

    View Slide

20. Ͳͷιϑτ΢ΣΞ͕
    ίϯϙʔωϯτͱͯ͠
    ԿΛ࢖͍ͬͯΔ͔
    ೺ѲͰ͖·͔͢ʁ
    19
    

    View Slide

21. ґଘઌͷґଘઌ
    ਪҠతґଘؔ܎
    ΋
    ݟམͱ͍ͯ͠·ͤΜ͔ʁ
    20
    

    View Slide

22. ղܾࡦͷͻͱͭ4#0.
    21
    

    View Slide

23. 4#0.ͱ͸
    • 4PGUXBSF#JMM0G.BUFSJBMT ιϑτ΢ΣΞ෦඼ද
    
    • ιϑτ΢ΣΞΛߏ੒͢Δίϯϙʔωϯτͱϝλσʔλͷ
    Ұཡ
    22
    

    View Slide

24. 4#0.ͰҰཡԽ͢Δίϯϙʔωϯτ
    • ιϑτ΢ΣΞ͕ґଘɾ࢖༻͢Δ044΍αʔυύʔςΟͷ
    ϥΠϒϥϦ
    • ιϑτ΢ΣΞ͕࢖͏ΞυΦϯɺϓϥάΠϯɺ֦ுػೳ
    • ϓϩϓϥΠΤλϦͳίʔυ
    • 4BB4ͷ৔߹
    "1*΍αʔυύʔςΟͷαʔϏεͷ৘ใ
    23
    

    View Slide

25. 4#0.ʹؚ·ΕΔ಺༰
    • ίϯϙʔωϯτͷαϓϥΠϠʔ
    • ίϯϙʔωϯτ໊
    • ίϯϙʔωϯτͷόʔδϣϯ
    • ίϯϙʔωϯτΛࣝผ͢ΔΩʔ
    • ґଘؔ܎
    • 4#0.ͷ࡞੒ऀ
    • λΠϜελϯϓ
    24
    

    View Slide

26. 4#0.ͷྫ
    25
    ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET
    IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG
    

    View Slide

27. ϑΥʔϚοτ
    • ඪ४Խ͕ਐΜͰ͍Δ
    • 4PGUXBSF1BDLBHF%BUB&YDIBOHF 41%9
    
    • 4PGUXBSF*EFOUJGJDBUJPO 48*%
    
    • $ZDMPOF%9 ͳͲ
    • UBHWBMVFܗࣜ 41%9
    ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ
    • ਓؒʹ΋ػցʹ΋ಡΊΔ
    26
    

    View Slide

28. ͳͥ4#0.͕໾ʹཱ͔ͭ
    • ࣍ͷΑ͏ͳ༻్Ͱ࢖͑Δ
    • ࢿ࢈؅ཧ
    • ϥΠηϯεɾίϯϓϥΠΞϯε؅ཧ
    • ஌తࡒ࢈؅ཧ
    • ੬ऑੑ؅ཧ
    • ΠϯγσϯτϨεϙϯε
    • ιϑτ΢ΣΞͷ҆શੑͷ֬ೝɾอূʹ໾ཱͭ
    27
    

    View Slide

29. ॏཁࢹ͞ΕΔ4#0.
    • ΞϝϦΧɿ೥݄ͷେ౷ྖྩͰɺ੓෎ͱऔҾͷ͋Δ
    ૊৫͸4#0.͕ඞਢͱͯٛ͠຿෇͚ΒΕͨ
    • ೔ຊͰ΋ࣗಈंۀքͳͲͰ׆༻͕޿·Δ
    28
    ग़యɿ ೔ܦ95&$) ೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ
    IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
    

    View Slide

30. ࣅͨΑ͏ͳ͜ͱΛ
    طʹ΍͍ͬͯΔํɺ
    ͍Βͬ͠ΌΔ͔΋͠Ε·ͤΜ
    29
    

    View Slide

31. ͋Δ͋Δͳ؅ཧ
    30
    &YDFMˢ
    ˣ໨Ͱ֬ೝ
    

    View Slide

32. View Slide

33. 4#0.؅ཧϕετϓϥΫςΟε
    • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͠ଓ͚Δ
    • πʔϧΛ࢖ͬͯࣗಈԽ͢Δ
    • ϦϦʔεͷͨͼʹߋ৽͢Δ
    • ϝλσʔλΛ͋Θͤͯอ࣋͢Δ
    • ӡ༻͍ͯ͠Δͷ͕4BB4Ͱ͋ͬͯ΋4#0.Λ࢖͏
    32
    

    View Slide

34. 4$"ʢιϑτ΢ΣΞίϯϙδγϣϯղੳʣ
    • 4#0.ͷ࡞੒ʹ͸ɺιϑτ΢ΣΞʹԿؚ͕·Ε͍ͯΔ͔
    ͷௐ͕ࠪ౰વඞཁͱͳΔ
    • ιϑτ΢ΣΞΛεΩϟϯͯ͠ߏ੒ͱ੬ऑੑɺϥΠηϯε
    ҧ൓ͳͲΛௐ΂Δ͜ͱΛ4$"ͱ͍͏
    • ੈͷதʹ͸༷ʑͳ4$"πʔϧ͕͋Γɺ͜ΕΛ࢖ͬͯ
    $*$%࣮ߦ࣌ʹ4$"΋ࣗಈͰߦ͏
    33
    

    View Slide

35. 4#0.ͷجຊΛ஌ͬͯ
    ͍͖ͨͩ·ͨ͠ʂ
    34
    

    View Slide

36. ͜ΕͰηΩϡϦςΟ͸
    όονϦʂ
    35
    

    View Slide

37. ͱ͸ͳΓ·ͤΜɾɾɾ
    36
    

    View Slide

38. ऴΘΓ͸ͳ͍
    • ஌ਓηΩϡϦςΟΤϯδχΞʮ͜ΕΛ΍ͬͨΒେৎ෉ͱ
    ͍͏͜ͱ͸ܾͯ͠ͳ͍ʯ
    37
    

    View Slide

39. ༷ʑͳηΩϡϦςΟରࡦ
    • ڴҖϞσϦϯά 5ISFBUNPEFMJOH
    
    • ੩తΞϓϦέʔγϣϯηΩϡϦςΟςετ 4"45
    
    • ಈతΞϓϦέʔγϣϯηΩϡϦςΟςετ %"45
    
    • ιϑτ΢ΣΞίϯϙδγϣϯղੳ 4$"
    
    • ϑΝδϯά GV[[JOH
    
    • ϖωτϨʔγϣϯςετ
    ͳͲ
    38
    

    View Slide

40. 39
    39
    ڴҖ
    ϞσϦ
    ϯά
    νΣοΫ
    Ξ΢τ
    Ϗϧυ ςετ ϦϦʔε σϓϩΠ
    4"45
    %"45
    ϖϯ
    ςετ
    4$"
    ϑΝδ
    ϯά
    4$"
    4$"
    ηΩϡϦςΟରࡦΛ4%-$ʹ૊ΈࠐΉ
    ˞ਤ͸ҰྫͰ͢
    

    View Slide

41. Կ͔Β΍Ε͹ʜ
    • Ͱ͖Δͱ͜Ζ͔Β࢝ΊΔ
    • ʮ੬ऑੑ਍அʯΛطʹ΍͍ͬͯΔ૊৫͸ଟ͍ͷͰ͸ͳ͍͔
    • ͜ΕʹՃ͑ͯ4$"ΛऔΓೖΕͯΈΔͷ͸Φεεϝ
    • ੬ऑੑΛݟ͚ͭΔͷ΋ݟ͔ͭͬͨ࣌ͷରԠ΋ൺֱత༰қ
    • πʔϧ ແྉ΋͋Δʂ
    ΛೖΕΔͷ͸ࣗࣾ಺Ͱ׬݁Ͱ͖Δ͜ͱ΋ଟ͘ɺ
    ਍அͷϓϩΛޏ͏ͷͱൺֱͯ͠΋खܰ
    • %"45ͱ4$"͕උΘΕ͹ɺͻͱ·ͣࣗ෼Ͱॻ͍ͨίʔυ΋औಘ
    ͨ͠ίʔυ΋ΧόʔͰ͖Δ
    40
    

    View Slide

42. ݸਓͰ࢝ΊΒΕΔ͜ͱ΋͋Δ
    • ͪΐͬͱ͚ͩͰ΋ηΩϡϦςΟͷχϡʔεΛݟͯΈΔ
    • ʮηΩϡϦςΟ࢖͍ͬͯΔαʔϏεʗݴޠ΍ٕज़ʯͱ͔ࡶ
    ʹݕࡧͯ͠Έͯ΋৭ʑग़ͯ͘Δ
    • ࣾ಺ͷηΩϡϦςΟ୲౰ͷํͱ࿩ͯ͠ΈΔ
    41
    

    View Slide

43. ؔ৺͕ͳ͍ͷ͕
    Ұ൪ةݥʂ
    42
    

    View Slide

44. աڈͷࢲ
    • ։ൃͦͷ΋ͷ͕ͦ͜ʮྑ͍΋ͷΛͭ͘Δʯ
    ߦҝͩͱೝ͍ࣝͯͨ͠
    • ηΩϡϦςΟରࡦ͸ʮΑ͘෼͔Βͳ͍͚Ͳ
    ΍Βͳ͖Ό͍͚ͳ͍΋ͷʯͩͬͨ
    • ηΩϡϦςΟ͕ͱʹ͔͘೉ͯ͘͠ා͔ͬͨ
    43
    !"#$%&'
    ()*
    +,-."/
    01."/234
    

    View Slide

45. ࠓࢥ͏͜ͱ
    44
    • ։ൃͨ͠΋ͷ͸҆શʹಧ͚ɺͦͷޙ΋҆શʹӡ༻͠ଓ͚
    ͳͯ͘͸ͳΒͳ͍
    • ηΩϡϦςΟ୲౰΋Ұॹʹ΋ͷͮ͘ΓΛ͢Δ஥ؒͰ͋Δ
    • ʮ෼͔Βͳ͍ʯͱ͍͏ࢥ͍ࠐΈ͕෼͔Βͳ͍ͯ͘͠Δ
    • ηΩϡϦςΟ͸ൣғ͕๲େͳͷͰɺ෼ղͯ͠ΈΔͱগ͠
    ͣͭཧղͰ͖Δ
    

    View Slide

46. ͪΐͬͱ͖͔͚ͨͬ͠Ͱ
    นΛ৐Γӽ͑ΒΕΔ
    ͪΐͬͱͣͭʜ
    
    45
    

    View Slide

47. ਎ۙͳ໰୊͔Β
    46
    • օ͕࿩୊ʹ͍ͯ͠ΔτϐοΫ
    • ࣗ෼͕ରԠͨ͠੬ऑੑ
    ग़యɿ *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺ
    ࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ
    IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
    

    View Slide

48. ৮Εͨ͜ͱͷ͋Δ΋ͷ͔Β
    47
    • ʮ੬ऑੑ਍அ͸ฉ͍ͨ͜ͱ͋Δ͚ͲɺͦΕҎ֎ʹ΋औΓ
    ૊ΊΔ࡞ۀ͕͋ͬͨΜͩͳ͊ʯ
    • ʮ044ͷόʔδϣϯ֬ೝɺखಈͰ΍Δͷ͠ΜͲ͗ͨ͢ʜ
    ࣗಈԽͰ͖Δπʔϧ͕͋ͬͨͳΜͯʂʯ
    

    View Slide

49. ͥͻ͜ͷηογϣϯ΋
    Կ͔ͷ͖͔͚ͬʹ
    ͍ͯͩ͘͠͞ʂ
    48
    

    View Slide

50. ͦͯ͠ԿΑΓ
    49
    

    View Slide

51. 4#0.׆༻Ͱ
    কདྷ΁ͷඋ͑Λʂ
    50
    

    View Slide

52. ࠓޙʹޤ͏͝ظ଴ʂ
    51
    

    View Slide

53. 53
    5IBOLZPV
    

    View Slide

54. ࢀߟจݙ
    • +FOOJGFS%BWJT 3ZO %BOJFMTʰ&GGFDUJWF %FW0QT ʕຊபʹΑΔ࣋ଓՄೳͳ૊৫จԽͷҭͯํʱ
    • ʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯIUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPG
    TFDVSJUZ
    • ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ
    IUUQTKBQBO[EOFUDPNBSUJDMF
    • +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPV
    OFFEUPLOPX
    • 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJH
    BTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG
    • ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$"
    ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM
    • ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS
    • ʮ4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSETʯ
    IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG
    • ೔ܦ95&$)೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ
    IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
    • *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ
    ͍ʯIUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
    • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ
    IUUQTXXXNFUJHPKQQSFTTQEG
    • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQ
    DPOUFOUVQMPBET#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG
    54
    54
    

    View Slide