Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SBOMでソフトウェアを守れ!10年後も自信を持ってリリースするために今始めるDevSecOp...

ihcomega56
February 18, 2022

SBOMでソフトウェアを守れ!10年後も自信を持ってリリースするために今始めるDevSecOps / DevSecOps with SBOM for yourself 10 years from now

Developers Summit 2022

ihcomega56

February 18, 2022
Tweet

More Decks by ihcomega56

Other Decks in Technology

Transcript

  1. Α͜ͳͰ͢ 3 • +'SPHͷ%FWFMPQFS"EWPDBUF • %FW0QTΛ੝Γ্͍͛ͯ͘κ • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ 4*FS ޿ࠂձࣾ

    ূ݊ελʔτΞοϓ • ઌिɺେਓʹͳͬͯॳͷˆΛܦݧ օ͞ΜҾ͖ଓ͖ࣗ͝Ѫ͍ͩ͘͞! !"#$$%&' (#)*+,%-.
  2. ηΩϡϦςΟͱ͍ͬͯ΋༷ʑ 9 • Πϯϑϥɺιϑτ΢ΣΞɺ ώϡʔϚϯΤϥʔͳͲؾʹ ͢΂͖͜ͱ͸ଟذʹΘͨΔ • %FW4FD0QTͷλʔήοτ͸ ιϑτ΢ΣΞͷηΩϡϦ ςΟͰ͋Δ

    ग़యʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯ IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ
  3. खͷಧ͘ൣғ͚ͩͷରࡦͰ͸଍Γͳ͍ • ࣗ෼Ͱॻ͍ͨίʔυ͕҆શͰ΋ɺऔಘͯ͠࢖ͬͨιϑτ ΢ΣΞʹ੬ऑੑ͕ݟ͔ͭΔՄೳੑ͕͋Δ • ࡢࠓɺϓϩϓϥΠΤλϦͳιϑτ΢ΣΞͷʙׂఔ౓͕ 044ͱݴΘΕ͍ͯΔ 17 ग़యɿ 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF

    3JTLJO."CZUIF/VNCFSTʯ IUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG ʮηΩϡϦςΟɾεΩϟϯʯ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁ IUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯ IUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS
  4. ϑΥʔϚοτ • ඪ४Խ͕ਐΜͰ͍Δ • 4PGUXBSF1BDLBHF%BUB&YDIBOHF 41%9 • 4PGUXBSF*EFOUJGJDBUJPO 48*% •

    $ZDMPOF%9 ͳͲ • UBHWBMVFܗࣜ 41%9 ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ • ਓؒʹ΋ػցʹ΋ಡΊΔ 26
  5. ͳͥ4#0.͕໾ʹཱ͔ͭ • ࣍ͷΑ͏ͳ༻్Ͱ࢖͑Δ • ࢿ࢈؅ཧ • ϥΠηϯεɾίϯϓϥΠΞϯε؅ཧ • ஌తࡒ࢈؅ཧ •

    ੬ऑੑ؅ཧ • ΠϯγσϯτϨεϙϯε • ιϑτ΢ΣΞͷ҆શੑͷ֬ೝɾอূʹ໾ཱͭ 27
  6. 31

  7. 39 39 ڴҖ ϞσϦ ϯά νΣοΫ Ξ΢τ Ϗϧυ ςετ ϦϦʔε

    σϓϩΠ 4"45 %"45 ϖϯ ςετ 4$" ϑΝδ ϯά 4$" 4$" ηΩϡϦςΟରࡦΛ4%-$ʹ૊ΈࠐΉ ˞ਤ͸ҰྫͰ͢
  8. Կ͔Β΍Ε͹ʜ • Ͱ͖Δͱ͜Ζ͔Β࢝ΊΔ • ʮ੬ऑੑ਍அʯΛطʹ΍͍ͬͯΔ૊৫͸ଟ͍ͷͰ͸ͳ͍͔ • ͜ΕʹՃ͑ͯ4$"ΛऔΓೖΕͯΈΔͷ͸Φεεϝ • ੬ऑੑΛݟ͚ͭΔͷ΋ݟ͔ͭͬͨ࣌ͷରԠ΋ൺֱత༰қ •

    πʔϧ ແྉ΋͋Δʂ ΛೖΕΔͷ͸ࣗࣾ಺Ͱ׬݁Ͱ͖Δ͜ͱ΋ଟ͘ɺ ਍அͷϓϩΛޏ͏ͷͱൺֱͯ͠΋खܰ • %"45ͱ4$"͕උΘΕ͹ɺͻͱ·ͣࣗ෼Ͱॻ͍ͨίʔυ΋औಘ ͨ͠ίʔυ΋ΧόʔͰ͖Δ 40
  9. ਎ۙͳ໰୊͔Β 46 • օ͕࿩୊ʹ͍ͯ͠ΔτϐοΫ • ࣗ෼͕ରԠͨ͠੬ऑੑ ग़యɿ *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺ

    ࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM
  10. ࢀߟจݙ • +FOOJGFS%BWJT 3ZO %BOJFMTʰ&GGFDUJWF %FW0QT ʕຊபʹΑΔ࣋ଓՄೳͳ૊৫จԽͷҭͯํʱ • ʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯIUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPG

    TFDVSJUZ • ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF • +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPV OFFEUPLOPX • 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF 3JTLJO."CZUIF/VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJH BTTFUTXIJUFQBQFSTXQSJTLNBOVNCFSTQEG • ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM • ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSETʯ IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@@WFSTJPO@QEG • ೔ܦ95&$)೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ ͍ʯIUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQ DPOUFOUVQMPBET#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG 54 54