$30 off During Our Annual Pro Sale. View Details »

SBOMでソフトウェアを守れ!10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

ihcomega56
February 18, 2022

SBOMでソフトウェアを守れ!10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

Developers Summit 2022

ihcomega56

February 18, 2022
Tweet

More Decks by ihcomega56

Other Decks in Technology

Transcript

  1. 4#0.Ͱιϑτ΢ΣΞΛकΕʂ ೥ޙ΋ࣗ৴Λ࣋ͬͯ ϦϦʔε͢ΔͨΊʹ ࠓ࢝ΊΔ%FW4FD0QT σϒαϛ

  2. %FW4FD0QTͷηογϣϯɺ ଟ͍Ͱ͢Ͷʂ 1

  3. ͦΜͳத͓ӽ͠Լ͞Γ ͋Γ͕ͱ͏͍͟͝·͢ 2

  4. Α͜ͳͰ͢ 3 • +'SPHͷ%FWFMPQFS"EWPDBUF • %FW0QTΛ੝Γ্͍͛ͯ͘κ • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ 4*FS ޿ࠂձࣾ

    ূ݊ελʔτΞοϓ • ઌिɺେਓʹͳͬͯॳͷˆΛܦݧ օ͞ΜҾ͖ଓ͖ࣗ͝Ѫ͍ͩ͘͞! !"#$$%&' (#)*+,%-.
  5. ࠓճͷσϒαϛςʔϚ ʮ೥ޙ΋ੈքͰ௨͡ΔΤϯδχΞͰ͋ΔͨΊʹʯ 4

  6. ೥ ͋ͬͱ͍͏͚ؒͩͲɺͨ͘͞Μͷ͜ͱ͕Ͱ͖Δ 5 ʙ೥લɺ೥લ͸ग़͖ͯͨͷʹ೥લ͚ͩग़ͯ͜ͳ͔ͬͨ(PPHMFQIPUPTʜ

  7. ͜ͷηογϣϯ͸ ೥ޙʹඋ͑ͯ ͍͔ʹ΋ͷͮ͘ΓΛ͢Δ͔ Ͱ͸ͳ͘ 6

  8. ͍͔ʹ΋ͷΛ҆શʹอ͔ͭɺ ҆શͳ΋ͷΛಧ͚Δ͔ ͷώϯτΛ͓ಧ͚͠·͢ 7

  9. %FW4FD0QTͱ͸ •%FWͱ0QTʹՃ͑ͯɺ4FDVSJUZ΋ ڠۀͯ͠ιϑτ΢ΣΞΛ࡞͍ͬͯ͘ • શһ͕શ෦Λग़དྷΔΑ͏ʹͳΔ ඞཁ͸ͳ͍ • ·ͣ͸ؙ౤͛͠ͳ͍ɺཧղ͢Δ • গ͓ͣͭ͠ޓ͍खΛ޿͛Δ

    8 8 ։ൃ ӡ༻ ηΩϡ ϦςΟ
  10. ηΩϡϦςΟͱ͍ͬͯ΋༷ʑ 9 • Πϯϑϥɺιϑτ΢ΣΞɺ ώϡʔϚϯΤϥʔͳͲؾʹ ͢΂͖͜ͱ͸ଟذʹΘͨΔ • %FW4FD0QTͷλʔήοτ͸ ιϑτ΢ΣΞͷηΩϡϦ ςΟͰ͋Δ

    ग़యʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯ IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ
  11. ιϑτ΢ΣΞͷηΩϡϦςΟʁ 10 10 %%PT߈ܸ 42-ΠϯδΣΫγϣϯ ϥϯαϜ΢ΣΞ ϑΟογϯά θϩσΠ߈ܸ ϒϧʔτϑΥʔεΞλοΫ

  12. ιϑτ΢ΣΞͷηΩϡϦςΟʁ 11 11

  13. ͦΜͳʹ୯७Ͱ͸ͳ͍ 12

  14. αϓϥΠνΣʔϯ߈ܸ 13

  15. αϓϥΠνΣʔϯ߈ܸ • ιϑτ΢ΣΞʹෆਖ਼ͳϓϩάϥϜ΍όοΫυΞΛ࢓ࠐΈɺ ͦͷιϑτ΢ΣΞΛऔಘͨ͠૬खʹରͯ͠߈ܸΛߦ͏ • ඪతΛ௚઀߈ܸͤͣɺ ଟ͘ͷ৔߹ɺΑΓηΩϡϦςΟ ରࡦ͕खബͳ ؔ࿈ձࣾ΍औҾઌΛૂͬͨ߈ܸΛߦ͏ 14

  16. ࠷ۙͷࣄྫ 15 15 ग़యɿ ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF

  17. ࠷ۙͷࣄྫ 16 16 ग़యɿ +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱ IUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX

  18. खͷಧ͘ൣғ͚ͩͷରࡦͰ͸଍Γͳ͍ • ࣗ෼Ͱॻ͍ͨίʔυ͕҆શͰ΋ɺऔಘͯ͠࢖ͬͨιϑτ ΢ΣΞʹ੬ऑੑ͕ݟ͔ͭΔՄೳੑ͕͋Δ • ࡢࠓɺϓϩϓϥΠΤλϦͳιϑτ΢ΣΞͷʙׂఔ౓͕ 044ͱݴΘΕ͍ͯΔ 17 ग़యɿ 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF

    3JTLJO."CZUIF/VNCFSTʯ IUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG ʮηΩϡϦςΟɾεΩϟϯʯ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁ IUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯ IUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS
  19. Կ͔͋ͬͨͱ͖ɺ ࣗ෼ͷιϑτ΢ΣΞ͕ େৎ෉͔͙͢෼͔Γ·͔͢ʁ 18

  20. Ͳͷιϑτ΢ΣΞ͕ ίϯϙʔωϯτͱͯ͠ ԿΛ࢖͍ͬͯΔ͔ ೺ѲͰ͖·͔͢ʁ 19

  21. ґଘઌͷґଘઌ ਪҠతґଘؔ܎ ΋ ݟམͱ͍ͯ͠·ͤΜ͔ʁ 20

  22. ղܾࡦͷͻͱͭ4#0. 21

  23. 4#0.ͱ͸ • 4PGUXBSF#JMM0G.BUFSJBMT ιϑτ΢ΣΞ෦඼ද • ιϑτ΢ΣΞΛߏ੒͢Δίϯϙʔωϯτͱϝλσʔλͷ Ұཡ 22

  24. 4#0.ͰҰཡԽ͢Δίϯϙʔωϯτ • ιϑτ΢ΣΞ͕ґଘɾ࢖༻͢Δ044΍αʔυύʔςΟͷ ϥΠϒϥϦ • ιϑτ΢ΣΞ͕࢖͏ΞυΦϯɺϓϥάΠϯɺ֦ுػೳ • ϓϩϓϥΠΤλϦͳίʔυ • 4BB4ͷ৔߹

    "1*΍αʔυύʔςΟͷαʔϏεͷ৘ใ 23
  25. 4#0.ʹؚ·ΕΔ಺༰ • ίϯϙʔωϯτͷαϓϥΠϠʔ • ίϯϙʔωϯτ໊ • ίϯϙʔωϯτͷόʔδϣϯ • ίϯϙʔωϯτΛࣝผ͢ΔΩʔ •

    ґଘؔ܎ • 4#0.ͷ࡞੒ऀ • λΠϜελϯϓ 24
  26. 4#0.ͷྫ 25 ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG

  27. ϑΥʔϚοτ • ඪ४Խ͕ਐΜͰ͍Δ • 4PGUXBSF1BDLBHF%BUB&YDIBOHF 41%9 • 4PGUXBSF*EFOUJGJDBUJPO 48*% •

    $ZDMPOF%9 ͳͲ • UBHWBMVFܗࣜ 41%9 ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ • ਓؒʹ΋ػցʹ΋ಡΊΔ 26
  28. ͳͥ4#0.͕໾ʹཱ͔ͭ • ࣍ͷΑ͏ͳ༻్Ͱ࢖͑Δ • ࢿ࢈؅ཧ • ϥΠηϯεɾίϯϓϥΠΞϯε؅ཧ • ஌తࡒ࢈؅ཧ •

    ੬ऑੑ؅ཧ • ΠϯγσϯτϨεϙϯε • ιϑτ΢ΣΞͷ҆શੑͷ֬ೝɾอূʹ໾ཱͭ 27
  29. ॏཁࢹ͞ΕΔ4#0. • ΞϝϦΧɿ೥݄ͷେ౷ྖྩͰɺ੓෎ͱऔҾͷ͋Δ ૊৫͸4#0.͕ඞਢͱͯٛ͠຿෇͚ΒΕͨ • ೔ຊͰ΋ࣗಈंۀքͳͲͰ׆༻͕޿·Δ 28 ग़యɿ ೔ܦ95&$) ೥݄೔ܝࡌ

    τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
  30. ࣅͨΑ͏ͳ͜ͱΛ طʹ΍͍ͬͯΔํɺ ͍Βͬ͠ΌΔ͔΋͠Ε·ͤΜ 29

  31. ͋Δ͋Δͳ؅ཧ 30 &YDFMˢ ˣ໨Ͱ֬ೝ

  32. 31

  33. 4#0.؅ཧϕετϓϥΫςΟε • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͠ଓ͚Δ • πʔϧΛ࢖ͬͯࣗಈԽ͢Δ • ϦϦʔεͷͨͼʹߋ৽͢Δ • ϝλσʔλΛ͋Θͤͯอ࣋͢Δ •

    ӡ༻͍ͯ͠Δͷ͕4BB4Ͱ͋ͬͯ΋4#0.Λ࢖͏ 32
  34. 4$"ʢιϑτ΢ΣΞίϯϙδγϣϯղੳʣ • 4#0.ͷ࡞੒ʹ͸ɺιϑτ΢ΣΞʹԿؚ͕·Ε͍ͯΔ͔ ͷௐ͕ࠪ౰વඞཁͱͳΔ • ιϑτ΢ΣΞΛεΩϟϯͯ͠ߏ੒ͱ੬ऑੑɺϥΠηϯε ҧ൓ͳͲΛௐ΂Δ͜ͱΛ4$"ͱ͍͏ • ੈͷதʹ͸༷ʑͳ4$"πʔϧ͕͋Γɺ͜ΕΛ࢖ͬͯ $*$%࣮ߦ࣌ʹ4$"΋ࣗಈͰߦ͏

    33
  35. 4#0.ͷجຊΛ஌ͬͯ ͍͖ͨͩ·ͨ͠ʂ 34

  36. ͜ΕͰηΩϡϦςΟ͸ όονϦʂ 35

  37. ͱ͸ͳΓ·ͤΜɾɾɾ 36

  38. ऴΘΓ͸ͳ͍ • ஌ਓηΩϡϦςΟΤϯδχΞʮ͜ΕΛ΍ͬͨΒେৎ෉ͱ ͍͏͜ͱ͸ܾͯ͠ͳ͍ʯ 37

  39. ༷ʑͳηΩϡϦςΟରࡦ • ڴҖϞσϦϯά 5ISFBUNPEFMJOH • ੩తΞϓϦέʔγϣϯηΩϡϦςΟςετ 4"45 • ಈతΞϓϦέʔγϣϯηΩϡϦςΟςετ %"45

    • ιϑτ΢ΣΞίϯϙδγϣϯղੳ 4$" • ϑΝδϯά GV[[JOH • ϖωτϨʔγϣϯςετ ͳͲ 38
  40. 39 39 ڴҖ ϞσϦ ϯά νΣοΫ Ξ΢τ Ϗϧυ ςετ ϦϦʔε

    σϓϩΠ 4"45 %"45 ϖϯ ςετ 4$" ϑΝδ ϯά 4$" 4$" ηΩϡϦςΟରࡦΛ4%-$ʹ૊ΈࠐΉ ˞ਤ͸ҰྫͰ͢
  41. Կ͔Β΍Ε͹ʜ • Ͱ͖Δͱ͜Ζ͔Β࢝ΊΔ • ʮ੬ऑੑ਍அʯΛطʹ΍͍ͬͯΔ૊৫͸ଟ͍ͷͰ͸ͳ͍͔ • ͜ΕʹՃ͑ͯ4$"ΛऔΓೖΕͯΈΔͷ͸Φεεϝ • ੬ऑੑΛݟ͚ͭΔͷ΋ݟ͔ͭͬͨ࣌ͷରԠ΋ൺֱత༰қ •

    πʔϧ ແྉ΋͋Δʂ ΛೖΕΔͷ͸ࣗࣾ಺Ͱ׬݁Ͱ͖Δ͜ͱ΋ଟ͘ɺ ਍அͷϓϩΛޏ͏ͷͱൺֱͯ͠΋खܰ • %"45ͱ4$"͕උΘΕ͹ɺͻͱ·ͣࣗ෼Ͱॻ͍ͨίʔυ΋औಘ ͨ͠ίʔυ΋ΧόʔͰ͖Δ 40
  42. ݸਓͰ࢝ΊΒΕΔ͜ͱ΋͋Δ • ͪΐͬͱ͚ͩͰ΋ηΩϡϦςΟͷχϡʔεΛݟͯΈΔ • ʮηΩϡϦςΟ ࢖͍ͬͯΔαʔϏεʗݴޠ΍ٕज़ʯͱ͔ࡶ ʹݕࡧͯ͠Έͯ΋৭ʑग़ͯ͘Δ • ࣾ಺ͷηΩϡϦςΟ୲౰ͷํͱ࿩ͯ͠ΈΔ 41

  43. ؔ৺͕ͳ͍ͷ͕ Ұ൪ةݥʂ 42

  44. աڈͷࢲ • ։ൃͦͷ΋ͷ͕ͦ͜ʮྑ͍΋ͷΛͭ͘Δʯ ߦҝͩͱೝ͍ࣝͯͨ͠ • ηΩϡϦςΟରࡦ͸ʮΑ͘෼͔Βͳ͍͚Ͳ ΍Βͳ͖Ό͍͚ͳ͍΋ͷʯͩͬͨ • ηΩϡϦςΟ͕ͱʹ͔͘೉ͯ͘͠ා͔ͬͨ 43

    !"#$%&' ()* +,-."/ 01."/234
  45. ࠓࢥ͏͜ͱ 44 • ։ൃͨ͠΋ͷ͸҆શʹಧ͚ɺͦͷޙ΋҆શʹӡ༻͠ଓ͚ ͳͯ͘͸ͳΒͳ͍ • ηΩϡϦςΟ୲౰΋Ұॹʹ΋ͷͮ͘ΓΛ͢Δ஥ؒͰ͋Δ • ʮ෼͔Βͳ͍ʯͱ͍͏ࢥ͍ࠐΈ͕෼͔Βͳ͍ͯ͘͠Δ •

    ηΩϡϦςΟ͸ൣғ͕๲େͳͷͰɺ෼ղͯ͠ΈΔͱগ͠ ͣͭཧղͰ͖Δ
  46. ͪΐͬͱ͖͔͚ͨͬ͠Ͱ นΛ৐Γӽ͑ΒΕΔ ͪΐͬͱͣͭʜ 45

  47. ਎ۙͳ໰୊͔Β 46 • օ͕࿩୊ʹ͍ͯ͠ΔτϐοΫ • ࣗ෼͕ରԠͨ͠੬ऑੑ ग़యɿ *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺ

    ࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
  48. ৮Εͨ͜ͱͷ͋Δ΋ͷ͔Β 47 • ʮ੬ऑੑ਍அ͸ฉ͍ͨ͜ͱ͋Δ͚ͲɺͦΕҎ֎ʹ΋औΓ ૊ΊΔ࡞ۀ͕͋ͬͨΜͩͳ͊ʯ • ʮ044ͷόʔδϣϯ֬ೝɺखಈͰ΍Δͷ͠ΜͲ͗ͨ͢ʜ ࣗಈԽͰ͖Δπʔϧ͕͋ͬͨͳΜͯʂʯ

  49. ͥͻ͜ͷηογϣϯ΋ Կ͔ͷ͖͔͚ͬʹ ͍ͯͩ͘͠͞ʂ 48

  50. ͦͯ͠ԿΑΓ 49

  51. 4#0.׆༻Ͱ কདྷ΁ͷඋ͑Λʂ 50

  52. ࠓޙʹޤ͏͝ظ଴ʂ 51

  53. 53 5IBOLZPV

  54. ࢀߟจݙ • +FOOJGFS%BWJT 3ZO %BOJFMTʰ&GGFDUJWF %FW0QT ʕຊபʹΑΔ࣋ଓՄೳͳ૊৫จԽͷҭͯํʱ • ʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯIUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPG

    TFDVSJUZ • ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF • +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPV OFFEUPLOPX • 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJH BTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG • ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM • ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSETʯ IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG • ೔ܦ95&$)೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ ͍ʯIUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQ DPOUFOUVQMPBET#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG 54 54