サプライチェーン・セキュリティ Infra Study 2nd #4「セキュリティエンジニアリングの世界」

Infra Study 2nd #4「セキュリティエンジニアリングの世界」
サプライチェーン・セキュリティ

昨今ではSolarWindsやKaseya's VSAのようにRansomewareによるサプライチェーンを狙った攻撃が大きく報道に上がっています。

2014年のGOM Playerのアップデートサーバーに代表される水飲み場型攻撃から、https://twitter.com/RKX1209/status/1376472166435184640?s=20　でつぶやかれ、そして2021/05における新たな大統領令が下った様に、防御側の観点でははずせない視点になっていくでしょう。それはdevopsという分野でも変わりません。

そこで、本講演ではローカルでの開発からデプロイまでありとあらゆるステージで、ところどころで見られるようになったConfidential Computing, Policy as CodeやOSS FOundationの活動を紹介しようと思います。

Transcript

1. αϓϥΠνΣʔϯɾηΩϡϦςΟ  1 *OGSB
   4UVEZ
   OE
   ʮηΩϡϦςΟΤϯδχΞϦϯάͷੈքʯ
2.  ໊લ
   ླ໦ݚޗ
   !LFOTDBM
    ॴଐ
   
    -BZFS9גࣜձࣾ
   $50ࣨ
    ࡾҪ෺࢈σδλϧΞηοτɾϚωδϝϯτग़޲
    དྷྺ
    ূ݊޲͚.BOBHFE
   4FDVSJUZ
   4FSWJDFɺՈܭ฽ɾΫϥ΢υձܭɺূ݊ձࣾ
    ݸਓͷ׆ಈ
    ಉਓʮ4FDVSFཱྀஂʯʹͯ1PEDBTUʮ4FDVSF
   -JBJTPOʯ΍ಉਓࢽ࡞੒
    िץʮ๩͍͠ਓͷͨΊͷηΩϡϦςΟɾΠϯςϦδΣϯεʯൃߦ
    ॻ੶
    0`3FJMMZʮ;FSP
   5SVTU
   /FUXPSLʯ؂༁
    ΠϯϓϨε3%ʮΞΠσϯςΟςΟ͸ͩΕͷ΋ͷʁ)ZQFSMFEHFS
   *OEZ
   
   "SJFTͰ࣮ݱ͢Δ෼ࢄΞΠσϯςΟςΟʯஶ࡞ ॴଐઌ঺հ
   
   ࣗݾ঺հ 2
3.  Ϧετ
    Ϧετ
    Ϧετ
    Ϧετͷڧௐจࣈ
    Ϧετ ݟग़͠ 3
4. ブロックチェーンの会社 ではないです 4 IUUQTOPUFDPNGVLLZZOOGFECD
5.  Ϧετ
    Ϧετ
    Ϧετ
    Ϧετͷڧௐจࣈ
    Ϧετ ݟग़͠ 5
6. 
   ʮίϯςφ΍
   ,VCFSOFUFT
   ͱ͍ͬͨ͜Ε͔ΒͷΠϯϑ ϥج൫ٕज़ʹ͓͚Δ߈ܸྫͱରࡦʯ
   લճ  ͷৼΓฦΓ 6 IUUQTTQFBLFSEFDLDPNNSUDJOIVSBKJQBOKJTIVGBMTFTFLJZVSJUFJUPLPSFLBSB
7. 
   ʮίϯςφ΍
   ,VCFSOFUFT
   ͱ͍ͬͨ͜Ε͔ΒͷΠϯϑ ϥج൫ٕज़ʹ͓͚Δ߈ܸྫͱରࡦʯ
   લճ  ͷৼΓฦΓ 7 IUUQTTQFBLFSEFDLDPNNSUDJOIVSBKJQBOKJTIVGBMTFTFLJZVSJUFJUPLPSFLBSB w ΨΠυϥΠϯ΍ࣗಈԽɾج൫ʹΑΔηΩϡϦςΟจԽͷৢ੒
   w $0ʢ$PNNVOJDBUJPO
   $PNQMFUFOFTT
   $POUJOVPVTʣ
   w 5FTU
   %SJWFO
   4FDVSJUZ
8.  ৅௃తͳΠϯγσϯτ
    ΠϯγσϯτΛड͚ͨಈ޲
    1VCMJD
   TFDUPSͷಈ͖
    044ͷಈ͖
    ϓϥοτϑΥʔϚʔͷಈ͖ ΞδΣϯμ 8
9. ৅௃తͳΠϯγσϯτ 9
10.  
    $PJODIFDL ະ਱
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʮ໊͓લDPNʯͰൃੜͨ͠ࣄ৅ʹ͍ͭͯ
     d
    4PMBS8JOET
     'JSF&ZF
    6OBVUIPSJ[FE
    "DDFTT
    PG
    'JSF&ZF
    3FE
    5FBN
    5PPMT
     .JDSPTPGU
    .JDSPTPGU
    *OUFSOBM
    4PMPSJHBUF
    *OWFTUJHBUJPO
    6QEBUF
     
    ۜߦޱ࠲ܦ༝Ͱͷෆਖ਼ૹۚ
     ʢυίϞޱ࠲ɺΏ͏ͪΐۜߦʣۜߦͷޱ࠲ೝূಥഁ͔ΒͷΩϟογϡϨεࣄۀऀܦ༝ͷෆਖ਼ग़ۚ
     ʢΏ͏ͪΐۜߦɾࡾඛ6'+ۜߦɺ4#*ূ݊ʣূ݊ձࣾͷϢʔβʔೝূಥഁ͔Βͷۜߦޱ࠲ܦ༝ͷෆਖ਼ग़ۚ
     
     ,BTFZB
    6QEBUFT
    3FHBSEJOH
    74"
    4FDVSJUZ
    *ODJEFOU
     
    
     -JRVJE
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʹ͓͚Δෆਖ਼ΞΫηεʹ͍ͭͯʢୈೋใʣ
     (P%BEEZ
    (P%BEEZ
    &NQMPZFFT
    6TFE
    JO
    "UUBDLT
    PO
    .VMUJQMF
    $SZQUPDVSSFODZ
    4FSWJDFT
     
    ࡾඛύϫʔ ϚωʔδυɾαʔϏεɾϓϩόΠμΛܦ༝ͨ͠ୈࡾऀ͔Βͷෆਖ਼ΞΫηε
     
    -*/&
    Ϣʔβʔͷݸਓ৘ใʹؔ͢ΔҰ෦ใಓʹ͍ͭͯ
     
    $PEF$PW
    #BTI
    6QMPBEFS
    4FDVSJUZ
    6QEBUF
     
    1)1
    1)1
    SFQPTJUPSZ
    NPWFE
    UP
    (JU)VC
    BGUFS
    NBMJDJPVT
    DPEF
    JOTFSUFE
    VOEFS
    DSFBUPS
    3BTNVT
    -FSEPSGT
    OBNF
     
    ถ࠷େڃͷੴ༉ύΠϓϥΠϯɺαΠόʔ߈ܸͰҰ࣌ఀࢭ
     
    ଜా੡࡞ॴ
    ଜా੡࡞ॴͷ࠶ҕୗઌ
    *#.தࠃ๏ਓࣾһɺۀ຿৘ใΛແஅ
    %-
    ˍ
    Ϋϥ΢υ΁Ξοϓ Πϯγσϯτ 10
11. ଞ૊৫ͷαʔϏεʹ
    ӨڹΛٴ΅͢ 11
12.  
    $PJODIFDL ະ਱
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʮ໊͓લDPNʯͰൃੜͨ͠ࣄ৅ʹ͍ͭͯ
     d
    4PMBS8JOET
     'JSF&ZF
    6OBVUIPSJ[FE
    "DDFTT
    PG
    'JSF&ZF
    3FE
    5FBN
    5PPMT
     .JDSPTPGU
    .JDSPTPGU
    *OUFSOBM
    4PMPSJHBUF
    *OWFTUJHBUJPO
    6QEBUF
     
    ۜߦޱ࠲ܦ༝Ͱͷෆਖ਼ૹۚ
     ʢυίϞޱ࠲ɺΏ͏ͪΐۜߦʣۜߦͷޱ࠲ೝূಥഁ͔ΒͷΩϟογϡϨεࣄۀऀܦ༝ͷෆਖ਼ग़ۚ
     ʢΏ͏ͪΐۜߦɾࡾඛ6'+ۜߦɺ4#*ূ݊ʣূ݊ձࣾͷϢʔβʔೝূಥഁ͔Βͷۜߦޱ࠲ܦ༝ͷෆਖ਼ग़ۚ
     
     ,BTFZB
    6QEBUFT
    3FHBSEJOH
    74"
    4FDVSJUZ
    *ODJEFOU
     
    
     (P%BEEZ
    (P%BEEZ
    &NQMPZFFT
    6TFE
    JO
    "UUBDLT
    PO
    .VMUJQMF
    $SZQUPDVSSFODZ
    4FSWJDFT
     -JRVJE
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʹ͓͚Δෆਖ਼ΞΫηεʹ͍ͭͯʢୈೋใʣ
     
    ࡾඛύϫʔ ϚωʔδυɾαʔϏεɾϓϩόΠμΛܦ༝ͨ͠ୈࡾऀ͔Βͷෆਖ਼ΞΫηε
     
    -*/&
    Ϣʔβʔͷݸਓ৘ใʹؔ͢ΔҰ෦ใಓʹ͍ͭͯ
     
    $PEF$PW
    #BTI
    6QMPBEFS
    4FDVSJUZ
    6QEBUF
     
    1)1
    1)1
    SFQPTJUPSZ
    NPWFE
    UP
    (JU)VC
    BGUFS
    NBMJDJPVT
    DPEF
    JOTFSUFE
    VOEFS
    DSFBUPS
    3BTNVT
    -FSEPSGT
    OBNF
     
    ถ࠷େڃͷੴ༉ύΠϓϥΠϯɺαΠόʔ߈ܸͰҰ࣌ఀࢭ
     
    ଜా੡࡞ॴ
    ଜా੡࡞ॴͷ࠶ҕୗઌ
    *#.தࠃ๏ਓࣾһɺۀ຿৘ใΛແஅ
    %-
    ˍ
    Ϋϥ΢υ΁Ξοϓ Πϯγσϯτ 12 ϓϥοτϑΥʔϜʹର͢Δ৵֐͔Β
    ൃੜͨ͠αʔϏε΁ͷӨڹ
13.  
    $PJODIFDL ະ਱
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʮ໊͓લDPNʯͰൃੜͨ͠ࣄ৅ʹ͍ͭͯ
     d
    4PMBS8JOET
     'JSF&ZF
    6OBVUIPSJ[FE
    "DDFTT
    PG
    'JSF&ZF
    3FE
    5FBN
    5PPMT
     .JDSPTPGU
    .JDSPTPGU
    *OUFSOBM
    4PMPSJHBUF
    *OWFTUJHBUJPO
    6QEBUF
     
    ۜߦޱ࠲ܦ༝Ͱͷෆਖ਼ૹۚ
     ʢυίϞޱ࠲ɺΏ͏ͪΐۜߦʣۜߦͷޱ࠲ೝূಥഁ͔ΒͷΩϟογϡϨεࣄۀऀܦ༝ͷෆਖ਼ग़ۚ
     ʢΏ͏ͪΐۜߦɾࡾඛ6'+ۜߦɺ4#*ূ݊ʣূ݊ձࣾͷϢʔβʔೝূಥഁ͔Βͷۜߦޱ࠲ܦ༝ͷෆਖ਼ग़ۚ
     
     ,BTFZB
    6QEBUFT
    3FHBSEJOH
    74"
    4FDVSJUZ
    *ODJEFOU
     
    
     -JRVJE
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʹ͓͚Δෆਖ਼ΞΫηεʹ͍ͭͯʢୈೋใʣ
     (P%BEEZ
    (P%BEEZ
    &NQMPZFFT
    6TFE
    JO
    "UUBDLT
    PO
    .VMUJQMF
    $SZQUPDVSSFODZ
    4FSWJDFT
     
    ࡾඛύϫʔ ϚωʔδυɾαʔϏεɾϓϩόΠμΛܦ༝ͨ͠ୈࡾऀ͔Βͷෆਖ਼ΞΫηε
     
    -*/&
    Ϣʔβʔͷݸਓ৘ใʹؔ͢ΔҰ෦ใಓʹ͍ͭͯ
     
    $PEF$PW
    #BTI
    6QMPBEFS
    4FDVSJUZ
    6QEBUF
     
    1)1
    1)1
    SFQPTJUPSZ
    NPWFE
    UP
    (JU)VC
    BGUFS
    NBMJDJPVT
    DPEF
    JOTFSUFE
    VOEFS
    DSFBUPS
    3BTNVT
    -FSEPSGT
    OBNF
     
    ถ࠷େڃͷੴ༉ύΠϓϥΠϯɺαΠόʔ߈ܸͰҰ࣌ఀࢭ
     
    ଜా੡࡞ॴ
    ଜా੡࡞ॴͷ࠶ҕୗઌ
    *#.தࠃ๏ਓࣾһɺۀ຿৘ใΛແஅ
    %-
    ˍ
    Ϋϥ΢υ΁Ξοϓ Πϯγσϯτ 13 ؂ࢹͳͲͷඇػೳཁ͔݅Βൃੜͨ͠
    αʔϏε΁ͷӨڹ
14.  
    $PJODIFDL ະ਱
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʮ໊͓લDPNʯͰൃੜͨ͠ࣄ৅ʹ͍ͭͯ
     d
    4PMBS8JOET
     'JSF&ZF
    6OBVUIPSJ[FE
    "DDFTT
    PG
    'JSF&ZF
    3FE
    5FBN
    5PPMT
     .JDSPTPGU
    .JDSPTPGU
    *OUFSOBM
    4PMPSJHBUF
    *OWFTUJHBUJPO
    6QEBUF
     
    ۜߦޱ࠲ܦ༝Ͱͷෆਖ਼ૹۚ
     ʢυίϞޱ࠲ɺΏ͏ͪΐۜߦʣۜߦͷޱ࠲ೝূಥഁ͔ΒͷΩϟογϡϨεࣄۀऀܦ༝ͷෆਖ਼ग़ۚ
     ʢΏ͏ͪΐۜߦɾࡾඛ6'+ۜߦɺ4#*ূ݊ʣূ݊ձࣾͷϢʔβʔೝূಥഁ͔Βͷۜߦޱ࠲ܦ༝ͷෆਖ਼ग़ۚ
     
     ,BTFZB
    6QEBUFT
    3FHBSEJOH
    74"
    4FDVSJUZ
    *ODJEFOU
     
    
     -JRVJE
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʹ͓͚Δෆਖ਼ΞΫηεʹ͍ͭͯʢୈೋใʣ
     (P%BEEZ
    (P%BEEZ
    &NQMPZFFT
    6TFE
    JO
    "UUBDLT
    PO
    .VMUJQMF
    $SZQUPDVSSFODZ
    4FSWJDFT
     
    ࡾඛύϫʔ ϚωʔδυɾαʔϏεɾϓϩόΠμΛܦ༝ͨ͠ୈࡾऀ͔Βͷෆਖ਼ΞΫηε
     
    -*/&
    Ϣʔβʔͷݸਓ৘ใʹؔ͢ΔҰ෦ใಓʹ͍ͭͯ
     
    $PEF$PW
    #BTI
    6QMPBEFS
    4FDVSJUZ
    6QEBUF
     
    1)1
    1)1
    SFQPTJUPSZ
    NPWFE
    UP
    (JU)VC
    BGUFS
    NBMJDJPVT
    DPEF
    JOTFSUFE
    VOEFS
    DSFBUPS
    3BTNVT
    -FSEPSGT
    OBNF
     
    ถ࠷େڃͷੴ༉ύΠϓϥΠϯɺαΠόʔ߈ܸͰҰ࣌ఀࢭ
     
    ଜా੡࡞ॴ
    ଜా੡࡞ॴͷ࠶ҕୗઌ
    *#.தࠃ๏ਓࣾһɺۀ຿৘ใΛແஅ
    %-
    ˍ
    Ϋϥ΢υ΁Ξοϓ Πϯγσϯτ 14 ৽͍͠αʔϏε͔Β
    چࣾձΠϯϑϥʢαʔϏεʣ΁ͷӨڹ
15.  
    $PJODIFDL ະ਱
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʮ໊͓લDPNʯͰൃੜͨ͠ࣄ৅ʹ͍ͭͯ
     d
    4PMBS8JOET
     'JSF&ZF
    6OBVUIPSJ[FE
    "DDFTT
    PG
    'JSF&ZF
    3FE
    5FBN
    5PPMT
     .JDSPTPGU
    .JDSPTPGU
    *OUFSOBM
    4PMPSJHBUF
    *OWFTUJHBUJPO
    6QEBUF
     
    ۜߦޱ࠲ܦ༝Ͱͷෆਖ਼ૹۚ
     ʢυίϞޱ࠲ɺΏ͏ͪΐۜߦʣۜߦͷޱ࠲ೝূಥഁ͔ΒͷΩϟογϡϨεࣄۀऀܦ༝ͷෆਖ਼ग़ۚ
     ʢΏ͏ͪΐۜߦɾࡾඛ6'+ۜߦɺ4#*ূ݊ʣূ݊ձࣾͷϢʔβʔೝূಥഁ͔Βͷۜߦޱ࠲ܦ༝ͷෆਖ਼ग़ۚ
     
     ,BTFZB
    6QEBUFT
    3FHBSEJOH
    74"
    4FDVSJUZ
    *ODJEFOU
     
    
     -JRVJE
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʹ͓͚Δෆਖ਼ΞΫηεʹ͍ͭͯʢୈೋใʣ
     (P%BEEZ
    (P%BEEZ
    &NQMPZFFT
    6TFE
    JO
    "UUBDLT
    PO
    .VMUJQMF
    $SZQUPDVSSFODZ
    4FSWJDFT
     
    ࡾඛύϫʔ ϚωʔδυɾαʔϏεɾϓϩόΠμΛܦ༝ͨ͠ୈࡾऀ͔Βͷෆਖ਼ΞΫηε
     
    -*/&
    Ϣʔβʔͷݸਓ৘ใʹؔ͢ΔҰ෦ใಓʹ͍ͭͯ
     
    $PEF$PW
    #BTI
    6QMPBEFS
    4FDVSJUZ
    6QEBUF
     
    1)1
    1)1
    SFQPTJUPSZ
    NPWFE
    UP
    (JU)VC
    BGUFS
    NBMJDJPVT
    DPEF
    JOTFSUFE
    VOEFS
    DSFBUPS
    3BTNVT
    -FSEPSGT
    OBNF
     
    ถ࠷େڃͷੴ༉ύΠϓϥΠϯɺαΠόʔ߈ܸͰҰ࣌ఀࢭ
     
    ଜా੡࡞ॴ
    ଜా੡࡞ॴͷ࠶ҕୗઌ
    *#.தࠃ๏ਓࣾһɺۀ຿৘ใΛແஅ
    %-
    ˍ
    Ϋϥ΢υ΁Ξοϓ Πϯγσϯτ 15 σϓϩΠલͷ։ൃஈ֊͔ΒͷӨڹ͕
    ٙΘΕΔΠϯγσϯτ
16.  
    $PJODIFDL ະ਱
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʮ໊͓લDPNʯͰൃੜͨ͠ࣄ৅ʹ͍ͭͯ
     d
    4PMBS8JOET
     'JSF&ZF
    6OBVUIPSJ[FE
    "DDFTT
    PG
    'JSF&ZF
    3FE
    5FBN
    5PPMT
     .JDSPTPGU
    .JDSPTPGU
    *OUFSOBM
    4PMPSJHBUF
    *OWFTUJHBUJPO
    6QEBUF
     
    ۜߦޱ࠲ܦ༝Ͱͷෆਖ਼ૹۚ
     ʢυίϞޱ࠲ɺΏ͏ͪΐۜߦʣۜߦͷޱ࠲ೝূಥഁ͔ΒͷΩϟογϡϨεࣄۀऀܦ༝ͷෆਖ਼ग़ۚ
     ʢΏ͏ͪΐۜߦɾࡾඛ6'+ۜߦɺ4#*ূ݊ʣূ݊ձࣾͷϢʔβʔೝূಥഁ͔Βͷۜߦޱ࠲ܦ༝ͷෆਖ਼ग़ۚ
     
     ,BTFZB
    6QEBUFT
    3FHBSEJOH
    74"
    4FDVSJUZ
    *ODJEFOU
     
    
     -JRVJE
    ౰ࣾར༻ͷυϝΠϯొ࿥αʔϏεʹ͓͚Δෆਖ਼ΞΫηεʹ͍ͭͯʢୈೋใʣ
     (P%BEEZ
    (P%BEEZ
    &NQMPZFFT
    6TFE
    JO
    "UUBDLT
    PO
    .VMUJQMF
    $SZQUPDVSSFODZ
    4FSWJDFT
     
    ࡾඛύϫʔ ϚωʔδυɾαʔϏεɾϓϩόΠμΛܦ༝ͨ͠ୈࡾऀ͔Βͷෆਖ਼ΞΫηε
     
    -*/&
    Ϣʔβʔͷݸਓ৘ใʹؔ͢ΔҰ෦ใಓʹ͍ͭͯ
     
    $PEF$PW
    #BTI
    6QMPBEFS
    4FDVSJUZ
    6QEBUF
     
    1)1
    1)1
    SFQPTJUPSZ
    NPWFE
    UP
    (JU)VC
    BGUFS
    NBMJDJPVT
    DPEF
    JOTFSUFE
    VOEFS
    DSFBUPS
    3BTNVT
    -FSEPSGT
    OBNF
     
    ถ࠷େڃͷੴ༉ύΠϓϥΠϯɺαΠόʔ߈ܸͰҰ࣌ఀࢭ
     
    ଜా੡࡞ॴ
    ଜా੡࡞ॴͷ࠶ҕୗઌ
    *#.தࠃ๏ਓࣾһɺۀ຿৘ใΛແஅ
    %-
    ˍ
    Ϋϥ΢υ΁Ξοϓ Πϯγσϯτ 16 ۀ຿ҕୗ͔Βͷ
    Өڹ
17. ΤϯυϢʔβʔ΁ͷՁ஋ఏڙ ΤϯυϢʔβʔ 17 αʔϏε
18. ΤϯυϢʔβʔ΁ͷՁ஋ఏڙ ΤϯυϢʔβʔ 18
19. lUIF
    MJOLFE
    TFU
    PG
    SFTPVSDFT
    BOE
    QSPDFTTFT
    CFUXFFO
    BOE
    BNPOH
    NVMUJQMF
    MFWFMT
    PG
    FOUFSQSJTFT
    FBDI
    PG
    XIJDI
    JT
    BO
    BDRVJSFS
    UIBU
    CFHJOT
    XJUI
    UIF
    TPVSDJOH
    PG
    QSPEVDUT
    BOE
    TFSWJDFT
    BOE
    FYUFOET
    UISPVHI
    UIFJS
    MJGF
    DZDMF
    l 19 IUUQTOWMQVCTOJTUHPWOJTUQVCT4QFDJBM1VCMJDBUJPOT/*4541SESBGUQEG
20. lUIF
    MJOLFE
    TFU
    PG
    SFTPVSDFT
    BOE
    QSPDFTTFT
    CFUXFFO
    BOE
    BNPOH
    NVMUJQMF
    MFWFMT
    PG
    FOUFSQSJTFT
    FBDI
    PG
    XIJDI
    JT
    BO
    BDRVJSFS
    UIBU
    CFHJOT
    XJUI
    UIF
    TPVSDJOH
    PG
    QSPEVDUT
    BOE
    TFSWJDFT
    BOE
    FYUFOET
    UISPVHI
    UIFJS
    MJGF
    DZDMF
    l 20 IUUQTOWMQVCTOJTUHPWOJTUQVCT4QFDJBM1VCMJDBUJPOT/*4541SESBGUQEG 4VQQMZ
    $IBJO
21. ݟग़͠ 21
22.  "MFY
    #JSTBO
     %FQFOEFODZ
    $POGVTJPO
    )PX
    *
    )BDLFE
    *OUP
    "QQMF
    .JDSPTPGU
    BOE
    %P[FOT
    PG
    0UIFS
    $PNQBOJFT
     !3ZPUB,
    .43$
    
    .PTU
    7BMVBCMF
    4FDVSJUZ
    3FTFBSDIFST
     )PNFCSFXͷ$BTLϦϙδτϦΛհͨ͠೚ҙίʔυ࣮ߦ
     3FNPUF
    DPEF
    FYFDVUJPO
    JO
    DEOKT
    PG
    $MPVE fl BSF
     OQNͷ!UZQFTείʔϓʹ͓͚Δ೚ҙͷύοέʔδͷվ᜵
     1Z1*ʹ͓͚Δજࡏతͳ೚ҙίʔυ࣮ߦ
     !3,9
    $&0'PVOEFS
    PG
    3JDFSDB
    4FDVSJUZ ͦ͏͍ͬͨ੬ऑੑʹ஫໨ͨ͠ઐ໳Ո 22 IUUQTUXJUUFSDPN3,9TUBUVT
23.  "MFY
    #JSTBO
     %FQFOEFODZ
    $POGVTJPO
    )PX
    *
    )BDLFE
    *OUP
    "QQMF
    .JDSPTPGU
    BOE
    %P[FOT
    PG
    0UIFS
    $PNQBOJFT
     !3ZPUB,
    .43$
    
    .PTU
    7BMVBCMF
    4FDVSJUZ
    3FTFBSDIFST
     )PNFCSFXͷ$BTLϦϙδτϦΛհͨ͠೚ҙίʔυ࣮ߦ
     3FNPUF
    DPEF
    FYFDVUJPO
    JO
    DEOKT
    PG
    $MPVE fl BSF
     OQNͷ!UZQFTείʔϓʹ͓͚Δ೚ҙͷύοέʔδͷվ᜵
     1Z1*ʹ͓͚Δજࡏతͳ೚ҙίʔυ࣮ߦ
     !3,9
    $&0'PVOEFS
    PG
    3JDFSDB
    4FDVSJUZ ͦ͏͍ͬͨ੬ऑੑʹ஫໨ͨ͠ઐ໳Ո 23 IUUQTUXJUUFSDPN3,9TUBUVT
24. 1VCMJD
    
    4FDUPSͷಈ͖ 24
25.  6OEFSTUBOEJOH
    UIF
    JODSFBTF
    JO
    4VQQMZ
    $IBJO
    4FDVSJUZ
    "UUBDLT
     4VQQMZ
    DIBJO߈ܸͷ෼ྨΛ੔ཧ
    
    4VQQMJFSͱ$VTUPNFSΛఆٛ͠ɺͦΕʹର͢Δ߈ܸʢBUUBDL
    UFDIOJRVFTʣͱλʔ ήοτʢBTTFUTʣΛମܥԽ
    
    dʹ͔͚ΔͷΠϯγσϯτΛ্هͷମܥʹ౰ͯ͸Ίͯ෼ੳ
    
    ࠷ऴతͳλʔήοτΛ߈ܸͨ͠͸αϓϥΠϠʔͱͷ৴པνΣʔϯΛѱ༻
    
    Πϯγσϯτͷ͸αϓϥΠϠʔͷίʔυΛૂͬͨ
    
    ࠷ऴతͳ໨తͷˋ͸σʔλ
    
    ߈ܸऀͷαϓϥΠϠʔଆͷ߈ܸख๏͸͸48ͷ੬ऑੑΛಥ͘΋ͷɻ͸ෆ໌ Ԥभ
    &/*4" 25
26.  ׭ຽؒͰͷڴҖ৘ใڞ༗
     ׭ிܥ΁ͷαΠόʔηΩϡϦςΟඪ४ͷϞμϯԽ
     ιϑτ΢ΣΞαϓϥΠνΣʔϯηΩϡϦςΟͷڧԽ
     αΠόʔηΩϡϦςΟ4BGFUZ
    3FWJFX
    #PBSEͷઃཱ
     ΠϯγσϯτରԠͷͨΊͷඪ४ϓϨΠϒοΫͷ࡞੒
     ௐࠪɾ؇࿨ೳྗͷ޲্ ถࠃ
    
    େ౷ྖྩ &0 
    
    *NQSPWJOH
    UIF
    /BUJPOT
    $ZCFSTFDVSJUZ 26
27.  ׭ຽؒͰͷڴҖ৘ใڞ༗
     ׭ிܥ΁ͷαΠόʔηΩϡϦςΟඪ४ͷϞμϯԽ
     ιϑτ΢ΣΞαϓϥΠνΣʔϯηΩϡϦςΟͷڧԽ
     αΠόʔηΩϡϦςΟ4BGFUZ
    3FWJFX
    #PBSEͷઃཱ
     ΠϯγσϯτରԠͷͨΊͷඪ४ϓϨΠϒοΫͷ࡞੒
     ௐࠪɾ؇࿨ೳྗͷ޲্ ถࠃ
    
    େ౷ྖྩ &0 
    
    *NQSPWJOH
    UIF
    /BUJPOT
    $ZCFSTFDVSJUZ 27 JNQSPWF
    UIF
    TFDVSJUZ
    BOE
    JOUFHSJUZ
    
    PG
    UIF
    TPGUXBSF
    TVQQMZ
    DIBJO
28.  *NQSPWJOH
    UIF
    /BUJPOT
    $ZCFSTFDVSJUZ
    /*45`T
    3FTQPOTJCJMJUJFT
    VOEFS
    UIF
    &YFDVUJWF
    0SEFS
     ιϑτ΢ΣΞηΩϡϦςΟධՁͷΫϥΠςϦΞ
     ։ൃऀ΍αϓϥΠϠʔͷηΩϡϦςΟධՁͷΫϥΠςϦΞ
     ηΩϡϦςΟϓϥΫςΟε΁ͷ४ڌঢ়ଶΛܭଌ ʢEFNPOTUSBUFʣ͢Δπʔϧɾख๏ &0ʹج͍ͮͨಈ͖ᶃ 28
29.  (VJEFMJOFT
    PO
    .JOJNVN
    4UBOEBSET
    GPS
    %FWFMPQFS
    7FSJ fi DBUJPO
    PG
    4PGUXBSF
     ։ൃͨ͠ιϑτΣΞͷ7FSJ fi DBUJPO ݕূ ͷͨΊͷϛχ ϚϜඪ४
     ڴҖϞσϦϯάɺࣗಈςετɺ4"45ɺ%"45ɺύοέʔ δνΣοΫΛؚΉ &0ʹج͍ͮͨಈ͖ᶄ 29
30. 044ͷಈ͖ 30
31.  ઃཱ
     ڞ௨ળͰ͋ΓɺϞμϯͳ48͓ΑͼΫϦςΟ ΧϧΠϯϑϥͷجૅͰ͋Δ044ͷηΩϡϦ ςΟΛଟํ໘తʹ֬อ͢Δ͜ͱ͕໨త
     4VQQMZ
    $IBJOͦͷ΋ͷΑΓ΋044։ൃͦ ͷ΋ͷͷ҆શੑΛ޲্ͤ͞Δ΋ͷʹݟ͑Δ 0QFO
    4PVSDF
    4FDVSJUZ
    'PVOEBUJPO 31
32.  *EFOUJGZJOH
    4FDVSJUZ
    5ISFBUT
     4FDVSJUZ
    5PPMJOH
    
     #FTU
    1SBDUJDFT
     7VMOFSBCJMJUZ
    %JTDMPTVSFT
     %JHJUBM
    *EFOUJUZ
    "UUFTUBUJPO
     4FDVSJOH
    $SJUJDBM
    1SPKFDUT 0QFO
    4PVSDF
    4FDVSJUZ
    'PVOEBUJPO
    8(T 32
33. *EFOUJGZJOH
    4FDVSJUZ
    5ISFBUT 33 IUUQTHJUIVCDPNPTTGXHJEFOUJGZJOHTFDVSJUZUISFBUTCMPCNBJO QVCMJDBUJPOTUISFBUTSJTLTNJUJHBUJPOTW4PVSDF&DPTZTUFN WQEG  044ʹؔ͢ΔηΩϡϦςΟϦε ΫͷڴҖͱ؇࿨ࡦ
     044ΤίγεςϜͷ֤ཁૉͱཁ ૉؒͷؔ܎Λ։ൃϑΣʔζʹ෼ ྨͨ͠ڴҖϞσϦϯά
34. 4DPSFDBSE
    1PMJDZ 
    "MMTUBSʢ&OGPSDFSʣ
    
    $SJUJDBMJUZ
    4DPSF 34  5ISFBU
    .PEFM΁ͷηΩϡϦςΟରࡦνΣοΫ
     ࣗಈతͳ෼ੳͱ෼ੳ݁Ռͷ৴པੑΛείΞϦϯά
    4DPSFDBSET
     4DPSFDBSETͷ݁Ռ͔Β0SH಺ͷϦϙδτϦʹରͯ͠JTTVF fi Yͳ ͲͷΞΫγϣϯΛ࣮ߦ͢Δʢ"MMTUBS
     $SJUJDBMMZ
    4DPSF͸ɺίϛοτස౓ͳͲͷύϥϝλ͔ΒӨڹ౓ͱॏ ཁੑΛ਺஋Խ͠ɺϓϩδΣΫτ͕Ͳͷఔ౓$SJUJDBM͔ΛείΞ෇͢ Δ
     ͜ΕʹΑΓɺηΩϡϦςΟରࡦͷ༏ઌ౓Λ෇͚ΒΕΔΑ͏ʹͳΔ IUUQTHJUIVCDPNPTTGTDPSFDBSE
35. 4FDVSJUZ
    .FUSJDT
    %BTICPBSE 35 IUUQTHJUIVCDPNPTTG1SPKFDU4FDVSJUZ.FUSJDT
36. 4VQQMZDIBJO
    -FWFMT
    GPS
    4PGUXBSF
    "SUJGBDUT 36 IUUQTTMTBEFW  Ϗϧυ͞ΕͨαϓϥΠνΣʔϯ಺ͷ 48ΞʔςΟϑΝΫτʢྫ
    όΠφϦʣ ͕ͲΕ͚͔ͩ֬ͳ΋ͷ͔ʢ׬શੑ͕୲ อ͞Ε͍ͯΔ͔ʣΛࣔ͢੒ख़౓Ϟσϧ
37. 37 { "_type": "https://in-toto.io/Statement/v0.1" , "subject": [ { "name": "salsa.txt" , "digest": { "sha256": "f8161d035cdf328c7bb124fce192cb90b603f34ca78d73e33b736b4f6bddf993" } }] , "predicateType": "https://in-toto.io/Provenance/v0.1" , "predicate": { "builder": { "id": "https://github.com/slsa-framework/github-actions-demo/Attestations/GitHubHostedActions@v1"} , "metadata": { "buildInvocationId": "https://github.com/slsa-framework/github-actions-demo/actions/runs/940567173" , "completeness": { "arguments": true , "environment": false , "materials": false } , "reproducible": false , "buildFinishedOn": "2021-06-15T20:04:10Z" } , "recipe": { "type": "https://github.com/Attestations/GitHubActionsWork fl ow@v1" , "de fi nedInMaterial": 0 , "entryPoint": "Create a sample provenance" , "arguments": { "foo": "baz" } , "environment": null } , "materials": [ { "uri": "git+https://github.com/slsa-framework/github-actions-demo" , "digest": { "sha1": "494b4d52182de3baedf592c4ac1dc597f0bd93b0"
38.  1SPGFTTJPOBM
    $FSUJ fi DBUF
    JO
    4FDVSF
    4PGUXBSF
    %FWFMPQNFOU
    'VOEBNFOUBMT
     08"41
    4FDVSJUZ
    ,OPXMFEHF
    'SBNFXPSL
    &EVDBUJPO5SBJOJOH 38
39.  αϓϥΠνΣʔϯʹ͔ܽͤͳ͍֤छॺ໊ٕज़Λఏڙ͢ΔϓϩδΣΫτ
     ॺ໊ͦͷ΋ͷ͸༰қ͚ͩͲɺπʔϧ͸Ξοϓϩʔυઌຖʹόϥόϥɻ ࢖͍ʹ͍͘΋ͷ΋ଟ͍
     IUUQTEPDTHPPHMFDPNQSFTFOUBUJPOE 9PTQ''EH3@W"&;"*9WVDJ(4KG*7[K;K0P3Z@P
     5PPMT
     $PTJHO
    ίϯςφΠϝʔδॺ໊ɾݕূɾอଘ
     GVMDJP
    0*%$ϕʔεͷϝΞυʹূ໌ॻΛൃߦ͢Δ3PPU$"
     3PPUTJHOJOH
    ϧʔτ伴ͷੜ੒ͱ56'ϝλσʔλͷॺ໊
     3FLUPS
    ॺ໊͓Αͼ伴ͷUSBOTQBSFODZ
    MPHͷݕূɾอଘ 4JHTUPSF
    OPU
    044' 39
40. ϓϥοτϑΥʔϚʔͷಈ͖ 40
41.  Ϣʔεέʔε
     ױऀͷσʔλΛෳ਺ͷΫϦχοΫɾපӃ͔ΒूΊͯ෼ੳ͢ΔαʔϏε
     ূ݊΍ۜߦͷऔҾ͕൓ࣾձ੎ྗ΍".-ʹؔΘͬͯͳ͍͔νΣοΫ͢Δ αʔϏε
     ެӹੑ͕ߴ͍ͱ͸͍͑ɺͱͯ΋4FOTJUJWF
     ͦͷࣄۀऀ͸Ռͨͯ͠৴པͰ͖Δͷ͔ʁ
     γεςϜۀ຿ҕୗઌͰ͋ΔΫϥ΢υࣄۀऀ͕ݖݶΛߦ࢖͢Δ͜ͱ͸ຊ౰ ʹͳ͍ͷ͔ʁ ϫʔΫϩʔυʹ͓͚Δ*OUFHSJUZ 41
42. $PO fi EFOUJBM
    $PNQVUJOH 42  ࣮ߦ͍ͯ͠ΔόΠφϦ͓Αͼ࣮ߦ؀ڥ͔Βࢉग़ͨ͠஋Λɺ࣮ࡍͷόΠ φϦΛর߹͢Δ͜ͱͰ͔֬ʢ5SVTUʣͰ͖Δ
    ʢ؂ࠪੑʣ
     ಉ࣌ʹϝϞϦ$16͕௨ৗͷ04͔Βִ཭͞Ε͍ͯΔͨΊɺΫϥ΢υࣄ ۀऀͳͲ͔Βσʔλ͕ൿಗ͞ΕΔʢൿಗੑʣ
     ྫ
     *OUFM
    4(9
    "[VSF
    ($1
    "-JCBCB
    "84
    /JUSP
    &ODMBWF
    .JDSPT 1MVUPO
    (PPHMF
    5JUBO
    -BZFS9
    "OPOJGZ
43. Ͳ͏͜ΕΒΛج൫ͱͯ͠
    ఆண͍͔ͤͯ͘͞ 43
44.  Ϧετ
     Ϧετ
     Ϧετ
     Ϧετͷڧௐจࣈ
     Ϧετ ݟग़͠ 44
45.  ΨΠυϥΠϯ΍ࣗಈԽɾج൫ʹΑΔηΩϡϦςΟจԽͷৢ੒
     $0ʢ$PNNVOJDBUJPO
    $PNQMFUFOFTT ɹ$POUJOVPVTʣ
     5FTU
    %SJWFO
    4FDVSJUZ ࠓޙ 45
46. 46 ࠾༻͸ͪ͜Β
    
    
    IUUQTIFSQDBSFFSTWMBZFSY ΧδϡΞϧ໘ஊ͸ͪ͜Β
    
    
    IUUQTNFFUZOFUBSUJDMFTUXXKK
47. 47 IUUQTNFFUZOFUNBUDIFTK"C ff [W-RK/B IUUQTIFSQDBSFFSTWMBZFSYZSR)(513Y
48. 5IBOL
    ZPV 48