Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SBOMでソフトウェアを守れ!10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

ihcomega56
February 18, 2022

SBOMでソフトウェアを守れ!10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

Developers Summit 2022

ihcomega56

February 18, 2022
Tweet

More Decks by ihcomega56

Other Decks in Technology

Transcript

  1. 4#0.Ͱιϑτ΢ΣΞΛकΕʂ
    ೥ޙ΋ࣗ৴Λ࣋ͬͯ
    ϦϦʔε͢ΔͨΊʹ
    ࠓ࢝ΊΔ%FW4FD0QT
    σϒαϛ

    View Slide

  2. %FW4FD0QTͷηογϣϯɺ
    ଟ͍Ͱ͢Ͷʂ
    1

    View Slide

  3. ͦΜͳத͓ӽ͠Լ͞Γ
    ͋Γ͕ͱ͏͍͟͝·͢
    2

    View Slide

  4. Α͜ͳͰ͢
    3
    • +'SPHͷ%FWFMPQFS"EWPDBUF
    • %FW0QTΛ੝Γ্͍͛ͯ͘κ
    • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ
    4*FS ޿ࠂձࣾ ূ݊ελʔτΞοϓ
    • ઌिɺେਓʹͳͬͯॳͷˆΛܦݧ
    օ͞ΜҾ͖ଓ͖ࣗ͝Ѫ͍ͩ͘͞!
    !"#$$%&'
    (#)*+,%-.

    View Slide

  5. ࠓճͷσϒαϛςʔϚ
    ʮ೥ޙ΋ੈքͰ௨͡ΔΤϯδχΞͰ͋ΔͨΊʹʯ
    4

    View Slide


  6. ͋ͬͱ͍͏͚ؒͩͲɺͨ͘͞Μͷ͜ͱ͕Ͱ͖Δ
    5
    ʙ೥લɺ೥લ͸ग़͖ͯͨͷʹ೥લ͚ͩग़ͯ͜ͳ͔ͬͨ(PPHMFQIPUPTʜ

    View Slide

  7. ͜ͷηογϣϯ͸
    ೥ޙʹඋ͑ͯ
    ͍͔ʹ΋ͷͮ͘ΓΛ͢Δ͔
    Ͱ͸ͳ͘
    6

    View Slide

  8. ͍͔ʹ΋ͷΛ҆શʹอ͔ͭɺ
    ҆શͳ΋ͷΛಧ͚Δ͔
    ͷώϯτΛ͓ಧ͚͠·͢
    7

    View Slide

  9. %FW4FD0QTͱ͸
    •%FWͱ0QTʹՃ͑ͯɺ4FDVSJUZ΋
    ڠۀͯ͠ιϑτ΢ΣΞΛ࡞͍ͬͯ͘
    • શһ͕શ෦Λग़དྷΔΑ͏ʹͳΔ
    ඞཁ͸ͳ͍
    • ·ͣ͸ؙ౤͛͠ͳ͍ɺཧղ͢Δ
    • গ͓ͣͭ͠ޓ͍खΛ޿͛Δ
    8
    8
    ։ൃ ӡ༻
    ηΩϡ
    ϦςΟ

    View Slide

  10. ηΩϡϦςΟͱ͍ͬͯ΋༷ʑ
    9
    • Πϯϑϥɺιϑτ΢ΣΞɺ
    ώϡʔϚϯΤϥʔͳͲؾʹ
    ͢΂͖͜ͱ͸ଟذʹΘͨΔ
    • %FW4FD0QTͷλʔήοτ͸
    ιϑτ΢ΣΞͷηΩϡϦ
    ςΟͰ͋Δ
    ग़యʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯ
    IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ

    View Slide

  11. ιϑτ΢ΣΞͷηΩϡϦςΟʁ
    10
    10
    %%PT߈ܸ
    42-ΠϯδΣΫγϣϯ
    ϥϯαϜ΢ΣΞ ϑΟογϯά
    θϩσΠ߈ܸ
    ϒϧʔτϑΥʔεΞλοΫ

    View Slide

  12. ιϑτ΢ΣΞͷηΩϡϦςΟʁ
    11
    11

    View Slide

  13. ͦΜͳʹ୯७Ͱ͸ͳ͍
    12

    View Slide

  14. αϓϥΠνΣʔϯ߈ܸ
    13

    View Slide

  15. αϓϥΠνΣʔϯ߈ܸ
    • ιϑτ΢ΣΞʹෆਖ਼ͳϓϩάϥϜ΍όοΫυΞΛ࢓ࠐΈɺ
    ͦͷιϑτ΢ΣΞΛऔಘͨ͠૬खʹରͯ͠߈ܸΛߦ͏
    • ඪతΛ௚઀߈ܸͤͣɺ ଟ͘ͷ৔߹ɺΑΓηΩϡϦςΟ
    ରࡦ͕खബͳ
    ؔ࿈ձࣾ΍औҾઌΛૂͬͨ߈ܸΛߦ͏
    14

    View Slide

  16. ࠷ۙͷࣄྫ
    15
    15
    ग़యɿ ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ
    IUUQTKBQBO[EOFUDPNBSUJDMF

    View Slide

  17. ࠷ۙͷࣄྫ
    16
    16
    ग़యɿ +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱ
    IUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX

    View Slide

  18. खͷಧ͘ൣғ͚ͩͷରࡦͰ͸଍Γͳ͍
    • ࣗ෼Ͱॻ͍ͨίʔυ͕҆શͰ΋ɺऔಘͯ͠࢖ͬͨιϑτ
    ΢ΣΞʹ੬ऑੑ͕ݟ͔ͭΔՄೳੑ͕͋Δ
    • ࡢࠓɺϓϩϓϥΠΤλϦͳιϑτ΢ΣΞͷʙׂఔ౓͕
    044ͱݴΘΕ͍ͯΔ
    17
    ग़యɿ 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯ
    IUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG
    ʮηΩϡϦςΟɾεΩϟϯʯ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$"
    ͱ͸ʁ
    IUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM
    ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯ
    IUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS

    View Slide

  19. Կ͔͋ͬͨͱ͖ɺ
    ࣗ෼ͷιϑτ΢ΣΞ͕
    େৎ෉͔͙͢෼͔Γ·͔͢ʁ
    18

    View Slide

  20. Ͳͷιϑτ΢ΣΞ͕
    ίϯϙʔωϯτͱͯ͠
    ԿΛ࢖͍ͬͯΔ͔
    ೺ѲͰ͖·͔͢ʁ
    19

    View Slide

  21. ґଘઌͷґଘઌ
    ਪҠతґଘؔ܎
    ΋
    ݟམͱ͍ͯ͠·ͤΜ͔ʁ
    20

    View Slide

  22. ղܾࡦͷͻͱͭ4#0.
    21

    View Slide

  23. 4#0.ͱ͸
    • 4PGUXBSF#JMM0G.BUFSJBMT ιϑτ΢ΣΞ෦඼ද

    • ιϑτ΢ΣΞΛߏ੒͢Δίϯϙʔωϯτͱϝλσʔλͷ
    Ұཡ
    22

    View Slide

  24. 4#0.ͰҰཡԽ͢Δίϯϙʔωϯτ
    • ιϑτ΢ΣΞ͕ґଘɾ࢖༻͢Δ044΍αʔυύʔςΟͷ
    ϥΠϒϥϦ
    • ιϑτ΢ΣΞ͕࢖͏ΞυΦϯɺϓϥάΠϯɺ֦ுػೳ
    • ϓϩϓϥΠΤλϦͳίʔυ
    • 4BB4ͷ৔߹
    "1*΍αʔυύʔςΟͷαʔϏεͷ৘ใ
    23

    View Slide

  25. 4#0.ʹؚ·ΕΔ಺༰
    • ίϯϙʔωϯτͷαϓϥΠϠʔ
    • ίϯϙʔωϯτ໊
    • ίϯϙʔωϯτͷόʔδϣϯ
    • ίϯϙʔωϯτΛࣝผ͢ΔΩʔ
    • ґଘؔ܎
    • 4#0.ͷ࡞੒ऀ
    • λΠϜελϯϓ
    24

    View Slide

  26. 4#0.ͷྫ
    25
    ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET
    [email protected]@[email protected]@[email protected]@@[email protected]

    View Slide

  27. ϑΥʔϚοτ
    • ඪ४Խ͕ਐΜͰ͍Δ
    • 4PGUXBSF1BDLBHF%BUB&YDIBOHF 41%9

    • 4PGUXBSF*EFOUJGJDBUJPO 48*%

    • $ZDMPOF%9 ͳͲ
    • UBHWBMVFܗࣜ 41%9
    ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ
    • ਓؒʹ΋ػցʹ΋ಡΊΔ
    26

    View Slide

  28. ͳͥ4#0.͕໾ʹཱ͔ͭ
    • ࣍ͷΑ͏ͳ༻్Ͱ࢖͑Δ
    • ࢿ࢈؅ཧ
    • ϥΠηϯεɾίϯϓϥΠΞϯε؅ཧ
    • ஌తࡒ࢈؅ཧ
    • ੬ऑੑ؅ཧ
    • ΠϯγσϯτϨεϙϯε
    • ιϑτ΢ΣΞͷ҆શੑͷ֬ೝɾอূʹ໾ཱͭ
    27

    View Slide

  29. ॏཁࢹ͞ΕΔ4#0.
    • ΞϝϦΧɿ೥݄ͷେ౷ྖྩͰɺ੓෎ͱऔҾͷ͋Δ
    ૊৫͸4#0.͕ඞਢͱͯٛ͠຿෇͚ΒΕͨ
    • ೔ຊͰ΋ࣗಈंۀքͳͲͰ׆༻͕޿·Δ
    28
    ग़యɿ ೔ܦ95&$) ೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ
    IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM

    View Slide

  30. ࣅͨΑ͏ͳ͜ͱΛ
    طʹ΍͍ͬͯΔํɺ
    ͍Βͬ͠ΌΔ͔΋͠Ε·ͤΜ
    29

    View Slide

  31. ͋Δ͋Δͳ؅ཧ
    30
    &YDFMˢ
    ˣ໨Ͱ֬ೝ

    View Slide

  32. 31

    View Slide

  33. 4#0.؅ཧϕετϓϥΫςΟε
    • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͠ଓ͚Δ
    • πʔϧΛ࢖ͬͯࣗಈԽ͢Δ
    • ϦϦʔεͷͨͼʹߋ৽͢Δ
    • ϝλσʔλΛ͋Θͤͯอ࣋͢Δ
    • ӡ༻͍ͯ͠Δͷ͕4BB4Ͱ͋ͬͯ΋4#0.Λ࢖͏
    32

    View Slide

  34. 4$"ʢιϑτ΢ΣΞίϯϙδγϣϯղੳʣ
    • 4#0.ͷ࡞੒ʹ͸ɺιϑτ΢ΣΞʹԿؚ͕·Ε͍ͯΔ͔
    ͷௐ͕ࠪ౰વඞཁͱͳΔ
    • ιϑτ΢ΣΞΛεΩϟϯͯ͠ߏ੒ͱ੬ऑੑɺϥΠηϯε
    ҧ൓ͳͲΛௐ΂Δ͜ͱΛ4$"ͱ͍͏
    • ੈͷதʹ͸༷ʑͳ4$"πʔϧ͕͋Γɺ͜ΕΛ࢖ͬͯ
    $*$%࣮ߦ࣌ʹ4$"΋ࣗಈͰߦ͏
    33

    View Slide

  35. 4#0.ͷجຊΛ஌ͬͯ
    ͍͖ͨͩ·ͨ͠ʂ
    34

    View Slide

  36. ͜ΕͰηΩϡϦςΟ͸
    όονϦʂ
    35

    View Slide

  37. ͱ͸ͳΓ·ͤΜɾɾɾ
    36

    View Slide

  38. ऴΘΓ͸ͳ͍
    • ஌ਓηΩϡϦςΟΤϯδχΞʮ͜ΕΛ΍ͬͨΒେৎ෉ͱ
    ͍͏͜ͱ͸ܾͯ͠ͳ͍ʯ
    37

    View Slide

  39. ༷ʑͳηΩϡϦςΟରࡦ
    • ڴҖϞσϦϯά 5ISFBUNPEFMJOH

    • ੩తΞϓϦέʔγϣϯηΩϡϦςΟςετ 4"45

    • ಈతΞϓϦέʔγϣϯηΩϡϦςΟςετ %"45

    • ιϑτ΢ΣΞίϯϙδγϣϯղੳ 4$"

    • ϑΝδϯά GV[[JOH

    • ϖωτϨʔγϣϯςετ
    ͳͲ
    38

    View Slide

  40. 39
    39
    ڴҖ
    ϞσϦ
    ϯά
    νΣοΫ
    Ξ΢τ
    Ϗϧυ ςετ ϦϦʔε σϓϩΠ
    4"45
    %"45
    ϖϯ
    ςετ
    4$"
    ϑΝδ
    ϯά
    4$"
    4$"
    ηΩϡϦςΟରࡦΛ4%-$ʹ૊ΈࠐΉ
    ˞ਤ͸ҰྫͰ͢

    View Slide

  41. Կ͔Β΍Ε͹ʜ
    • Ͱ͖Δͱ͜Ζ͔Β࢝ΊΔ
    • ʮ੬ऑੑ਍அʯΛطʹ΍͍ͬͯΔ૊৫͸ଟ͍ͷͰ͸ͳ͍͔
    • ͜ΕʹՃ͑ͯ4$"ΛऔΓೖΕͯΈΔͷ͸Φεεϝ
    • ੬ऑੑΛݟ͚ͭΔͷ΋ݟ͔ͭͬͨ࣌ͷରԠ΋ൺֱత༰қ
    • πʔϧ ແྉ΋͋Δʂ
    ΛೖΕΔͷ͸ࣗࣾ಺Ͱ׬݁Ͱ͖Δ͜ͱ΋ଟ͘ɺ
    ਍அͷϓϩΛޏ͏ͷͱൺֱͯ͠΋खܰ
    • %"45ͱ4$"͕උΘΕ͹ɺͻͱ·ͣࣗ෼Ͱॻ͍ͨίʔυ΋औಘ
    ͨ͠ίʔυ΋ΧόʔͰ͖Δ
    40

    View Slide

  42. ݸਓͰ࢝ΊΒΕΔ͜ͱ΋͋Δ
    • ͪΐͬͱ͚ͩͰ΋ηΩϡϦςΟͷχϡʔεΛݟͯΈΔ
    • ʮηΩϡϦςΟ࢖͍ͬͯΔαʔϏεʗݴޠ΍ٕज़ʯͱ͔ࡶ
    ʹݕࡧͯ͠Έͯ΋৭ʑग़ͯ͘Δ
    • ࣾ಺ͷηΩϡϦςΟ୲౰ͷํͱ࿩ͯ͠ΈΔ
    41

    View Slide

  43. ؔ৺͕ͳ͍ͷ͕
    Ұ൪ةݥʂ
    42

    View Slide

  44. աڈͷࢲ
    • ։ൃͦͷ΋ͷ͕ͦ͜ʮྑ͍΋ͷΛͭ͘Δʯ
    ߦҝͩͱೝ͍ࣝͯͨ͠
    • ηΩϡϦςΟରࡦ͸ʮΑ͘෼͔Βͳ͍͚Ͳ
    ΍Βͳ͖Ό͍͚ͳ͍΋ͷʯͩͬͨ
    • ηΩϡϦςΟ͕ͱʹ͔͘೉ͯ͘͠ා͔ͬͨ
    43
    !"#$%&'
    ()*
    +,-."/
    01."/234

    View Slide

  45. ࠓࢥ͏͜ͱ
    44
    • ։ൃͨ͠΋ͷ͸҆શʹಧ͚ɺͦͷޙ΋҆શʹӡ༻͠ଓ͚
    ͳͯ͘͸ͳΒͳ͍
    • ηΩϡϦςΟ୲౰΋Ұॹʹ΋ͷͮ͘ΓΛ͢Δ஥ؒͰ͋Δ
    • ʮ෼͔Βͳ͍ʯͱ͍͏ࢥ͍ࠐΈ͕෼͔Βͳ͍ͯ͘͠Δ
    • ηΩϡϦςΟ͸ൣғ͕๲େͳͷͰɺ෼ղͯ͠ΈΔͱগ͠
    ͣͭཧղͰ͖Δ

    View Slide

  46. ͪΐͬͱ͖͔͚ͨͬ͠Ͱ
    นΛ৐Γӽ͑ΒΕΔ
    ͪΐͬͱͣͭʜ

    45

    View Slide

  47. ਎ۙͳ໰୊͔Β
    46
    • օ͕࿩୊ʹ͍ͯ͠ΔτϐοΫ
    • ࣗ෼͕ରԠͨ͠੬ऑੑ
    ग़యɿ *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺ
    ࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ
    IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM

    View Slide

  48. ৮Εͨ͜ͱͷ͋Δ΋ͷ͔Β
    47
    • ʮ੬ऑੑ਍அ͸ฉ͍ͨ͜ͱ͋Δ͚ͲɺͦΕҎ֎ʹ΋औΓ
    ૊ΊΔ࡞ۀ͕͋ͬͨΜͩͳ͊ʯ
    • ʮ044ͷόʔδϣϯ֬ೝɺखಈͰ΍Δͷ͠ΜͲ͗ͨ͢ʜ
    ࣗಈԽͰ͖Δπʔϧ͕͋ͬͨͳΜͯʂʯ

    View Slide

  49. ͥͻ͜ͷηογϣϯ΋
    Կ͔ͷ͖͔͚ͬʹ
    ͍ͯͩ͘͠͞ʂ
    48

    View Slide

  50. ͦͯ͠ԿΑΓ
    49

    View Slide

  51. 4#0.׆༻Ͱ
    কདྷ΁ͷඋ͑Λʂ
    50

    View Slide

  52. ࠓޙʹޤ͏͝ظ଴ʂ
    51

    View Slide

  53. 53
    5IBOLZPV

    View Slide

  54. ࢀߟจݙ
    • +FOOJGFS%BWJT 3ZO %BOJFMTʰ&GGFDUJWF %FW0QT ʕຊபʹΑΔ࣋ଓՄೳͳ૊৫จԽͷҭͯํʱ
    • ʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯIUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPG
    TFDVSJUZ
    • ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ
    IUUQTKBQBO[EOFUDPNBSUJDMF
    • +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPV
    OFFEUPLOPX
    • 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJH
    BTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG
    • ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$"
    ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM
    • ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS
    • ʮ4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSETʯ
    [email protected]@[email protected]@[email protected]@@[email protected]
    • ೔ܦ95&$)೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ
    IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
    • *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ
    ͍ʯIUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
    • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ
    IUUQTXXXNFUJHPKQQSFTTQEG
    • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQ
    DPOUFOUVQMPBET#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG
    54
    54

    View Slide