Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Javaアプリケーションの アーティファクト管理と DevSecOps / Java arti...

ihcomega56
November 21, 2021

Javaアプリケーションの アーティファクト管理と DevSecOps / Java artifacts management and DevSecOps

JJUG CCC 2021 Fall

ihcomega56

November 21, 2021
Tweet

More Decks by ihcomega56

Other Decks in Technology

Transcript

  1. ͦ΋ͦ΋ηΩϡϦςΟͬͯʜ 4 • Πϯϑϥɺιϑτ΢ΣΞɺ ώϡʔϚϯΤϥʔͳͲؾʹ ͢΂͖͜ͱ͸ଟذʹΘͨΔ • શͯΛηΩϡϦςΟ୲౰ʹ ؙ౤͛ͤͣɺαʔϏεվળ ͷͨΊʹڠྗΛଓ͚Δ

    • %FW4FD0QTͷλʔήοτ͸ ιϑτ΢ΣΞͷηΩϡϦ ςΟͰ͋Δ ʮ8IBUBSFUIFMBZFSTPGTFDVSJUZ "DZCFSTFDVSJUZSFQPSUʯ IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ
  2. ڀۃͷΰʔϧΛ໨ࢦͯ͠ • ϦϦʔεճ਺Λ૿΍͢ ϦϦʔε·Ͱͷ࣌ؒΛ୹͘͢Δ • ࡞ۀΛޮ཰Խ͢Δ • ࡞ۀΛεέʔϧͤ͞Δ • ϛε΍τϥϒϧΛݮΒ͢

    ૣ͘ݟ͚ͭͯରԠ͢Δ ˠʮ%FW0QTʯ΍ʮΞδϟΠϧ։ൃʯ͸จԽɺ࢟੎ͱ ͯ͜͠ΕΛ໨ࢦ͢ αʔϏεͷվળ͸΋ͪΖΜɺϦιʔεෆ଍΍໘౗ͳ࡞ۀͱ͍ͬͨ ։ൃऀ๊͕͑Δ਎ۙͳ೰Έͷλωʹ΋ޮ͘ 6
  3. 12 ιϑτ΢ΣΞͷηΩϡϦςΟ΋৭ʑ 12 ڴҖ ϞσϦϯά 4"45 %"45 ϖϯςετ 4$" ϑΝδϯά

    4"45 ϒϥοΫ ϘοΫε ςετ %"45 ϖϯςετ ϗϫΠτ ϘοΫε ςετ ϑΝδϯά 4$" ˞ਤ͸ҰྫͰ͢ νΣοΫ Ξ΢τ Ϗϧυ ςετ ϦϦʔε σϓϩΠ
  4. ιʔείʔυ WTΞʔςΟϑΝΫτ 33 ιʔείʔυ • ։ൃʹΑΔվमͷର৅Ͱ͋Γ ϏδωεϩδοΫΛ͸͡Ίͱ ͢Δಠࣗͷ੒Ռ෺ʹ͋ͨΔ • (JUͳͲͷόʔδϣϯ؅ཧ͕

    ਁಁ͍ͯ͠Δ ΞʔςΟϑΝΫτ • ґଘղܾ͕ࡁΜͰ͓Γಠࣗͷ ίʔυҎ֎ͷ෦඼΋ؚ·ΕΔ • ग़ՙ σϓϩΠ ର৅ͱͳΔ • ઐ༻πʔϧͰͷ؅ཧ͸ίʔυ ͱൺֱ͢Δͱਁಁ͍ͯ͠ͳ͍
  5. ΞʔςΟϑΝΫτ͕ॏཁͳཧ༝ 34 • ґଘղܾ͕ࡁΜͰ͍Δ • ग़ՙର৅ͱͳΔ ˣ • ࠷ऴతʹαʔόʔͰಈ͘΋ͷʹؚ·ΕΔ044ͷνΣοΫ ͕ՄೳͱͳΔ

    • ιʔε಺ͷઃఆϑΝΠϧʹ͸ʮύοέʔδϚωʔδϟʔ͕Կ Λऔಘ༧ఆ͔ʯͱ͍͏৘ใ͔͠ͳ͍ • ಉ͡ιʔείʔυΛϏϧυͯ͠΋ɺΞʔςΟϑΝΫτͷத਎ ͕ຖճಉ͡ͱ͸ݶΒͳ͍ ^*_&*3Q `*a21b6c deRfg QXYPQ./
  6. 35 ΞʔςΟϑΝΫτ͕ॏཁͳཧ༝ ίʔσΟϯά Ϗϧυ ςετσϓϩΠ ݁߹ςετ ୯ମςετ ຊ൪σϓϩΠ ӡ༻ ΞʔςΟϑΝΫτ

    ஀ੜ ΞʔςΟϑΝΫτ͕࢖ΘΕଓ͚Δ ౓ੜ੒ͨ͠Βຊ൪σϓϩΠ·Ͱಉ͡΋ͷΛ࢖͏ !"#$%&'() *+,-./012 34/56789: ;<2=1>)=1? ιʔείʔυ͕ ΞʔςΟϑΝΫτʹͳΔ·Ͱ
  7. 37 όΠφϦɾ ϦϙδτϦϚωʔδϟʔ࢖͍ํᶃ औಘ͢Δ อ؅͢Δ • ࡞੒ͨ͠ΞʔςΟϑΝΫτ͸ʮϩʔΧϧϦϙδτϦʯ ʹอ؅͠ɺγΣΞ΍࠶ར༻Λ͢Δ • ಉ͡ίʔυΛԿ౓΋Ϗϧυ͢ΔͷΛආ͚

    ࣌ؒΛઅ໿Ͱ͖Δ ٸ͗ͷ੾Γ໭͠ʹ΋ศརʂ • ඼࣭͕୲อ͞ΕͨΞʔςΟϑΝΫτΛ ࢖͍ճͤΔ hijchk% l*9mnop q#Z[/RPP .%rstuvwx. QVTI EFQMPZ  QVCMJTI QVMM  SFTPMWF
  8. 43 όΠφϦɾ ϦϙδτϦϚωʔδϟʔ ·ͱΊ 43 • ࡞੒ɾऔಘͨ͠ΞʔςΟϑΝΫτΛอ؅͠ɺ࠶ར༻΍ ഑෍͕Ͱ͖ΔΑ͏ʹ͢Δ • ͜͜ͰΞʔςΟϑΝΫτʹର͢ΔεΩϟϯΛ࣮ࢪ͠ɺ

    ࢖༻͍ͯ͠Δ044ͷηΩϡϦςΟνΣοΫ 4$" Λߦ͏ ιʔείʔυղੳɺαʔόʔͰՔಇ͍ͯ͠ΔΞϓϦͷ਍அͱ͸ੑ࣭͕ҟͳΔ • $*$%ύΠϓϥΠϯʹ૊ΈࠐΉ͜ͱͰΞʔςΟϑΝΫτ ͷऔಘɾอ؅ɾεΩϟϯͳͲΛશͯࣗಈͰߦ͏ • ࣗಈԽɾޮ཰ԽͷͨΊʹϝλσʔλ͕͔ܽͤͳ͍
  9. 44 ࣮ݱ͍ͨ͠ύΠϓϥΠϯ 44 อ؅ͨ͠ λΠϛϯάͰ 4$" 7$4 #3. TFSWFST TFSWFST

    ϦϦʔεલʹ 4$" νΣοΫ Ξ΢τ Ϗϧυ ςετ ϦϦʔε σϓϩΠ
  10. 4/"14)05ઐ༻ͷϦϙδτϦ 51 • SFMFBTFόʔδϣϯͱTOBQTIPUόʔδϣϯΛ෼͚ΔจԽ .BWFO༝དྷ ʹͪͳΜͰɺϩʔΧϧϦϙδτϦΛ෼͚ͯ ࡞੒͢Δ͜ͱ͕ଟ͍ • SFMFBTF҆ఆɺෆม 74TOBQTIPU։ൃதɺมߋՄೳ

    • ໾ׂ΍ϥΠϑαΠΫϧ͕ҟͳΔͷͰ෼͚Δͱ͍͏ߟ͑ํ ྫ͑͹ɺTOBQTIPU͸ফ͑ͨΓյΕͨΓͨ࣌͠ͷӨڹ͕খ͍͞ • ϩʔΧϧϦϙδτϦΛ෼͚ΔͱϦϞʔτϦϙδτϦ΋ͭ • ಉ͡ϦϙδτϦʹೖΕͯϝλσʔλͰࣝผ͢Δ͜ͱ΋Ͱ͖Δ
  11. πʔϧΛ௥Ճͨ͠Β 52 • 044ͷεΩϟϯ͸ʮ౰ͨΓલʯͱͯ͠ܧଓతʹ࣮ࢪ͢Δ • /(͕͋ͬͨࡍͷϑϩʔΛ༧ΊܾΊɺܭըஈ֊ͰߟྀʹೖΕΔ • ʮࠓճ͚ͩεΩϟϯΛεΩοϓʂʯʮٸ͔͗ͩΒεϧʔʂʯͱ ϧʔϧΛܗ֚Խͤ͞ͳ͍ •

    ࣗಈεΩϟϯͱਓྗͷ࡞ۀΛ૊Έ߹Θͤͯ044Λ׆༻͢Δ • ྫ͑͹ͦ΋ͦ΋ͷٕज़બఆʹ͸ਓͷ൑அ ࢖͍উखɺߋ৽ස౓ɺ ϝϯςφʔͷ਺ͳͲΛ;·͑ͯ ͕ඞཁͱͳΔ • εΩϟϯͰݟ͔ͭͬͨ/(ʹͲ͏ରԠ͢Δ͔ʹ͍ͭͯ΋൑அ͕ ඞཁͱͳΔ͜ͱ͕͋Δ • ॏཁͳ൑அʹ࣌ؒΛׂͨ͘Ίʹ΋ࣗಈԽ͕༗ޮͱͳΔ
  12. ࢀߟจݙ • +FOOJGFS%BWJT 3ZO %BOJFMTʰ&GGFDUJWF %FW0QT ʕຊபʹΑΔ࣋ଓՄೳͳ૊৫จԽͷҭͯํʱ • ʮ8IBUJT%FW0QT ʯIUUQTKGSPHDPNEFWPQTUPPMTXIBUJTEFWPQT

    • ʮ8IBU BSF UIF  MBZFST PG TFDVSJUZ " DZCFSTFDVSJUZ SFQPSUʯ IUUQTHPNJOETJHIUDPNJOTJHIUTCMPHXIBUBSFUIFMBZFSTPGTFDVSJUZ • ʮ&YQMPSF ZPVS 044 EFQFOEFODJFT 7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTT EFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ+BWB EFQFOEFODZ NBOBHFNFOU IPX NBOZ MJOFT PG DPEF EPFT NZ BQQMJDBUJPO IPME ʯ IUUQTTOZLJPCMPHKBWBEFQFOEFODZNBOBHFNFOU • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ೔ܦΫϩεςοΫ ೥݄೔ܝࡌʮ · ͨ ΋ 4USVUT ੬ ऑ ੑ ඃ ֐ ɺ ࠃ ަ ল Ͱ ໿  ສ ݅ ͷ ৘ ใ ྲྀ ग़ ͔ ʯ IUUQTYUFDIOJLLFJDPNJUBUDMOFXT • ೔ܦΫϩεςοΫ ೥݄೔ܝࡌʮ 8FCαΠτͷ੬ऑੑΛ೥લ͔Β์ஔ͔ɺϝχίϯ৘ใ࿙ӮͷݪҼʯ IUUQTYUFDIOJLLFJDPNBUDMOYUDPMVNO • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯ IUUQTNFEJBKGSPHDPNXQDPOUFOUVQMPBET#FTUQSBDUJDFTGPSJOUSPEVDJOH +'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG 60 60