SBOMでソフトウェアを守れ！10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

Developers Summit 2022

Transcript

1. 4#0.Ͱιϑτ΢ΣΞΛकΕʂ ೥ޙ΋ࣗ৴Λ࣋ͬͯ ϦϦʔε͢ΔͨΊʹ ࠓ࢝ΊΔ%FW4FD0QT 
   σϒαϛ
2. %FW4FD0QTͷηογϣϯɺ ଟ͍Ͱ͢Ͷʂ 1
3. ͦΜͳத͓ӽ͠Լ͞Γ ͋Γ͕ͱ͏͍͟͝·͢ 2
4. Α͜ͳͰ͢ 3 • +'SPHͷ%FWFMPQFS
   "EWPDBUF • %FW0QTΛ੝Γ্͍͛ͯ͘κ • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ 4*FS 
   ޿ࠂձࣾ 
   ূ݊ελʔτΞοϓ • ઌिɺେਓʹͳͬͯॳͷˆΛܦݧ օ͞ΜҾ͖ଓ͖ࣗ͝Ѫ͍ͩ͘͞! !"#$$%&' (#)*+,%-.
5. ࠓճͷσϒαϛςʔϚ ʮ೥ޙ΋ੈքͰ௨͡ΔΤϯδχΞͰ͋ΔͨΊʹʯ 4
6. ೥ ͋ͬͱ͍͏͚ؒͩͲɺͨ͘͞Μͷ͜ͱ͕Ͱ͖Δ 5 ʙ೥લɺ೥લ͸ग़͖ͯͨͷʹ೥લ͚ͩग़ͯ͜ͳ͔ͬͨ(PPHMF
   QIPUPTʜ
7. ͜ͷηογϣϯ͸ ೥ޙʹඋ͑ͯ ͍͔ʹ΋ͷͮ͘ΓΛ͢Δ͔ Ͱ͸ͳ͘ 6
8. ͍͔ʹ΋ͷΛ҆શʹอ͔ͭɺ ҆શͳ΋ͷΛಧ͚Δ͔ ͷώϯτΛ͓ಧ͚͠·͢ 7
9. %FW4FD0QTͱ͸ •%FWͱ0QTʹՃ͑ͯɺ4FDVSJUZ΋ ڠۀͯ͠ιϑτ΢ΣΞΛ࡞͍ͬͯ͘ • શһ͕શ෦Λग़དྷΔΑ͏ʹͳΔ ඞཁ͸ͳ͍ • ·ͣ͸ؙ౤͛͠ͳ͍ɺཧղ͢Δ • গ͓ͣͭ͠ޓ͍खΛ޿͛Δ 8 8 ։ൃ ӡ༻ ηΩϡ ϦςΟ
10. ηΩϡϦςΟͱ͍ͬͯ΋༷ʑ 9 • Πϯϑϥɺιϑτ΢ΣΞɺ ώϡʔϚϯΤϥʔͳͲؾʹ ͢΂͖͜ͱ͸ଟذʹΘͨΔ • %FW4FD0QTͷλʔήοτ͸ ιϑτ΢ΣΞͷηΩϡϦ ςΟͰ͋Δ ग़య
    ʮ8IBU
    BSF
    UIF
    
    MBZFST
    PG
    TFDVSJUZ
    "
    DZCFSTFDVSJUZ
    SFQPSUʯ IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ
11. ιϑτ΢ΣΞͷηΩϡϦςΟʁ 10 10 %%PT߈ܸ 42-ΠϯδΣΫγϣϯ ϥϯαϜ΢ΣΞ ϑΟογϯά θϩσΠ߈ܸ ϒϧʔτϑΥʔεΞλοΫ
12. ιϑτ΢ΣΞͷηΩϡϦςΟʁ 11 11
13. ͦΜͳʹ୯७Ͱ͸ͳ͍ 12
14. αϓϥΠνΣʔϯ߈ܸ 13
15. αϓϥΠνΣʔϯ߈ܸ • ιϑτ΢ΣΞʹෆਖ਼ͳϓϩάϥϜ΍όοΫυΞΛ࢓ࠐΈɺ ͦͷιϑτ΢ΣΞΛऔಘͨ͠૬खʹରͯ͠߈ܸΛߦ͏ • ඪతΛ௚઀߈ܸͤͣɺ ଟ͘ͷ৔߹ɺΑΓηΩϡϦςΟ ରࡦ͕खബͳ ؔ࿈ձࣾ΍औҾઌΛૂͬͨ߈ܸΛߦ͏ 14
16. ࠷ۙͷࣄྫ 15 15 ग़యɿ ;%/FU
    ೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF
17. ࠷ۙͷࣄྫ 16 16 ग़యɿ +'SPH
    ೥݄೔ܝࡌʮ-PH4IFMM
    θϩσΠ
    ஌͓ͬͯ͘΂͖͜ͱ IUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX
18. खͷಧ͘ൣғ͚ͩͷରࡦͰ͸଍Γͳ͍ • ࣗ෼Ͱॻ͍ͨίʔυ͕҆શͰ΋ɺऔಘͯ͠࢖ͬͨιϑτ ΢ΣΞʹ੬ऑੑ͕ݟ͔ͭΔՄೳੑ͕͋Δ • ࡢࠓɺϓϩϓϥΠΤλϦͳιϑτ΢ΣΞͷʙׂఔ౓͕ 044ͱݴΘΕ͍ͯΔ 17 ग़యɿ 4ZOPQTZT
    XIJUFQBQFSʮ0QFO
    4PVSDF 3JTL
    JO
    ."
    CZ
    UIF
    /VNCFSTʯ IUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG ʮηΩϡϦςΟɾεΩϟϯʯ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁ IUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM ʮ&YQMPSF
    ZPVS
    044
    EFQFOEFODJFT
    7JTVBMMZʯ IUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS
19. Կ͔͋ͬͨͱ͖ɺ ࣗ෼ͷιϑτ΢ΣΞ͕ େৎ෉͔͙͢෼͔Γ·͔͢ʁ 18
20. Ͳͷιϑτ΢ΣΞ͕ ίϯϙʔωϯτͱͯ͠ ԿΛ࢖͍ͬͯΔ͔ ೺ѲͰ͖·͔͢ʁ 19
21. ґଘઌͷґଘઌ ਪҠతґଘؔ܎ ΋ ݟམͱ͍ͯ͠·ͤΜ͔ʁ 20
22. ղܾࡦͷͻͱͭ
    4#0. 21
23. 4#0.ͱ͸ • 4PGUXBSF
    #JMM
    0G
    .BUFSJBMT
    ιϑτ΢ΣΞ෦඼ද • ιϑτ΢ΣΞΛߏ੒͢Δίϯϙʔωϯτͱϝλσʔλͷ Ұཡ 22
24. 4#0.ͰҰཡԽ͢Δίϯϙʔωϯτ • ιϑτ΢ΣΞ͕ґଘɾ࢖༻͢Δ044΍αʔυύʔςΟͷ ϥΠϒϥϦ • ιϑτ΢ΣΞ͕࢖͏ΞυΦϯɺϓϥάΠϯɺ֦ுػೳ • ϓϩϓϥΠΤλϦͳίʔυ • 4BB4ͷ৔߹ "1*΍αʔυύʔςΟͷαʔϏεͷ৘ใ 23
25. 4#0.ʹؚ·ΕΔ಺༰ • ίϯϙʔωϯτͷαϓϥΠϠʔ • ίϯϙʔωϯτ໊ • ίϯϙʔωϯτͷόʔδϣϯ • ίϯϙʔωϯτΛࣝผ͢ΔΩʔ • ґଘؔ܎ • 4#0.ͷ࡞੒ऀ • λΠϜελϯϓ 24
26. 4#0.ͷྫ 25 ग़యɿ 4VSWFZ
    PG
    &YJTUJOH
    4#0.
    'PSNBUT
    BOE
    4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG
27. ϑΥʔϚοτ • ඪ४Խ͕ਐΜͰ͍Δ • 4PGUXBSF
    1BDLBHF
    %BUB
    &YDIBOHF
    41%9 • 4PGUXBSF
    *EFOUJGJDBUJPO
    48*% • $ZDMPOF%9 ͳͲ • UBHWBMVFܗࣜ 41%9 ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ • ਓؒʹ΋ػցʹ΋ಡΊΔ 26
28. ͳͥ4#0.͕໾ʹཱ͔ͭ • ࣍ͷΑ͏ͳ༻్Ͱ࢖͑Δ • ࢿ࢈؅ཧ • ϥΠηϯεɾίϯϓϥΠΞϯε؅ཧ • ஌తࡒ࢈؅ཧ • ੬ऑੑ؅ཧ • ΠϯγσϯτϨεϙϯε • ιϑτ΢ΣΞͷ҆શੑͷ֬ೝɾอূʹ໾ཱͭ 27
29. ॏཁࢹ͞ΕΔ4#0. • ΞϝϦΧɿ೥݄ͷେ౷ྖྩͰɺ੓෎ͱऔҾͷ͋Δ ૊৫͸4#0.͕ඞਢͱͯٛ͠຿෇͚ΒΕͨ • ೔ຊͰ΋ࣗಈंۀքͳͲͰ׆༻͕޿·Δ 28 ग़యɿ ೔ܦ95&$) ೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
30. ࣅͨΑ͏ͳ͜ͱΛ طʹ΍͍ͬͯΔํɺ ͍Βͬ͠ΌΔ͔΋͠Ε·ͤΜ 29
31. ͋Δ͋Δͳ؅ཧ 30 &YDFMˢ ˣ໨Ͱ֬ೝ
33. 4#0.؅ཧϕετϓϥΫςΟε • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͠ଓ͚Δ • πʔϧΛ࢖ͬͯࣗಈԽ͢Δ • ϦϦʔεͷͨͼʹߋ৽͢Δ • ϝλσʔλΛ͋Θͤͯอ࣋͢Δ • ӡ༻͍ͯ͠Δͷ͕4BB4Ͱ͋ͬͯ΋4#0.Λ࢖͏ 32
34. 4$"ʢιϑτ΢ΣΞίϯϙδγϣϯղੳʣ • 4#0.ͷ࡞੒ʹ͸ɺιϑτ΢ΣΞʹԿؚ͕·Ε͍ͯΔ͔ ͷௐ͕ࠪ౰વඞཁͱͳΔ • ιϑτ΢ΣΞΛεΩϟϯͯ͠ߏ੒ͱ੬ऑੑɺϥΠηϯε ҧ൓ͳͲΛௐ΂Δ͜ͱΛ4$"ͱ͍͏ • ੈͷதʹ͸༷ʑͳ4$"πʔϧ͕͋Γɺ͜ΕΛ࢖ͬͯ $*$%࣮ߦ࣌ʹ4$"΋ࣗಈͰߦ͏ 33
35. 4#0.ͷجຊΛ஌ͬͯ ͍͖ͨͩ·ͨ͠ʂ 34
36. ͜ΕͰηΩϡϦςΟ͸ όονϦʂ 35
37. ͱ͸ͳΓ·ͤΜɾɾɾ 36
38. ऴΘΓ͸ͳ͍ • ஌ਓηΩϡϦςΟΤϯδχΞʮ͜ΕΛ΍ͬͨΒେৎ෉ͱ ͍͏͜ͱ͸ܾͯ͠ͳ͍ʯ 37
39. ༷ʑͳηΩϡϦςΟରࡦ • ڴҖϞσϦϯά 5ISFBU
    NPEFMJOH • ੩తΞϓϦέʔγϣϯηΩϡϦςΟςετ 4"45 • ಈతΞϓϦέʔγϣϯηΩϡϦςΟςετ %"45 • ιϑτ΢ΣΞίϯϙδγϣϯղੳ 4$" • ϑΝδϯά GV[[JOH • ϖωτϨʔγϣϯςετ ͳͲ 38
40. 39 39 ڴҖ ϞσϦ ϯά νΣοΫ Ξ΢τ Ϗϧυ ςετ ϦϦʔε σϓϩΠ 4"45 %"45 ϖϯ ςετ 4$" ϑΝδ ϯά 4$" 4$" ηΩϡϦςΟରࡦΛ4%-$ʹ૊ΈࠐΉ ˞ਤ͸ҰྫͰ͢
41. Կ͔Β΍Ε͹ʜ • Ͱ͖Δͱ͜Ζ͔Β࢝ΊΔ • ʮ੬ऑੑ਍அʯΛطʹ΍͍ͬͯΔ૊৫͸ଟ͍ͷͰ͸ͳ͍͔ • ͜ΕʹՃ͑ͯ4$"ΛऔΓೖΕͯΈΔͷ͸Φεεϝ • ੬ऑੑΛݟ͚ͭΔͷ΋ݟ͔ͭͬͨ࣌ͷରԠ΋ൺֱత༰қ • πʔϧ ແྉ΋͋Δʂ ΛೖΕΔͷ͸ࣗࣾ಺Ͱ׬݁Ͱ͖Δ͜ͱ΋ଟ͘ɺ ਍அͷϓϩΛޏ͏ͷͱൺֱͯ͠΋खܰ • %"45ͱ4$"͕උΘΕ͹ɺͻͱ·ͣࣗ෼Ͱॻ͍ͨίʔυ΋औಘ ͨ͠ίʔυ΋ΧόʔͰ͖Δ 40
42. ݸਓͰ࢝ΊΒΕΔ͜ͱ΋͋Δ • ͪΐͬͱ͚ͩͰ΋ηΩϡϦςΟͷχϡʔεΛݟͯΈΔ • ʮηΩϡϦςΟ ࢖͍ͬͯΔαʔϏεʗݴޠ΍ٕज़ʯͱ͔ࡶ ʹݕࡧͯ͠Έͯ΋৭ʑग़ͯ͘Δ • ࣾ಺ͷηΩϡϦςΟ୲౰ͷํͱ࿩ͯ͠ΈΔ 41
43. ؔ৺͕ͳ͍ͷ͕ Ұ൪ةݥʂ 42
44. աڈͷࢲ • ։ൃͦͷ΋ͷ͕ͦ͜ʮྑ͍΋ͷΛͭ͘Δʯ ߦҝͩͱೝ͍ࣝͯͨ͠ • ηΩϡϦςΟରࡦ͸ʮΑ͘෼͔Βͳ͍͚Ͳ ΍Βͳ͖Ό͍͚ͳ͍΋ͷʯͩͬͨ • ηΩϡϦςΟ͕ͱʹ͔͘೉ͯ͘͠ා͔ͬͨ 43 !"#$%&' ()* +,-."/ 01."/234
45. ࠓࢥ͏͜ͱ 44 • ։ൃͨ͠΋ͷ͸҆શʹಧ͚ɺͦͷޙ΋҆શʹӡ༻͠ଓ͚ ͳͯ͘͸ͳΒͳ͍ • ηΩϡϦςΟ୲౰΋Ұॹʹ΋ͷͮ͘ΓΛ͢Δ஥ؒͰ͋Δ • ʮ෼͔Βͳ͍ʯͱ͍͏ࢥ͍ࠐΈ͕෼͔Βͳ͍ͯ͘͠Δ • ηΩϡϦςΟ͸ൣғ͕๲େͳͷͰɺ෼ղͯ͠ΈΔͱগ͠ ͣͭཧղͰ͖Δ
46. ͪΐͬͱ͖͔͚ͨͬ͠Ͱ นΛ৐Γӽ͑ΒΕΔ ͪΐͬͱͣͭʜ 45
47. ਎ۙͳ໰୊͔Β 46 • օ͕࿩୊ʹ͍ͯ͠ΔτϐοΫ • ࣗ෼͕ରԠͨ͠੬ऑੑ ग़యɿ *5NFEJB /&84
    ೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺ ࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
48. ৮Εͨ͜ͱͷ͋Δ΋ͷ͔Β 47 • ʮ੬ऑੑ਍அ͸ฉ͍ͨ͜ͱ͋Δ͚ͲɺͦΕҎ֎ʹ΋औΓ ૊ΊΔ࡞ۀ͕͋ͬͨΜͩͳ͊ʯ • ʮ044ͷόʔδϣϯ֬ೝɺखಈͰ΍Δͷ͠ΜͲ͗ͨ͢ʜ ࣗಈԽͰ͖Δπʔϧ͕͋ͬͨͳΜͯʂʯ
49. ͥͻ͜ͷηογϣϯ΋ Կ͔ͷ͖͔͚ͬʹ ͍ͯͩ͘͠͞ʂ 48
50. ͦͯ͠ԿΑΓ 49
51. 4#0.׆༻Ͱ কདྷ΁ͷඋ͑Λʂ 50
52. ࠓޙʹޤ͏͝ظ଴ʂ 51
53. 53 5IBOL
    ZPV
54. ࢀߟจݙ • +FOOJGFS
    %BWJT
    3ZO %BOJFMTʰ&GGFDUJWF %FW0QT ʕຊபʹΑΔ࣋ଓՄೳͳ૊৫จԽͷҭͯํʱ • ʮ8IBU
    BSF
    UIF
    
    MBZFST
    PG
    TFDVSJUZ
    "
    DZCFSTFDVSJUZ
    SFQPSUʯIUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPG TFDVSJUZ • ;%/FU
    ೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF • +'SPH
    ೥݄೔ܝࡌʮ-PH4IFMM
    θϩσΠ
    ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPV OFFEUPLOPX • 4ZOPQTZT
    XIJUFQBQFSʮ0QFO
    4PVSDF 3JTL
    JO
    ."
    CZ
    UIF
    /VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJH BTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG • ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM • ʮ&YQMPSF
    ZPVS
    044
    EFQFOEFODJFT
    7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ4VSWFZ
    PG
    &YJTUJOH
    4#0.
    'PSNBUT
    BOE
    4UBOEBSETʯ IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG • ೔ܦ95&$)
    ೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • *5NFEJB /&84
    ೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ ͍ʯIUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ʮ#FTU
    QSBDUJDFT
    GPS
    JOUSPEVDJOH
    +'SPH
    9SBZ
    JOUP
    ZPVS
    %FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQ DPOUFOUVQMPBET#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG 54 54