Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AlmaLinuxのパッケージはどこから来たんだろう

 AlmaLinuxのパッケージはどこから来たんだろう

koedoyoshida

August 30, 2023
Tweet

More Decks by koedoyoshida

Other Decks in Technology

Transcript

  1. alma-sbomの使い方 ソースと依存を取得してインストール $ git clone https://github.com/almalinux/alma-sbom $ cd alma-sbom $

    python3 -m venv env $ . env/bin/activate $ python3 setup.py install immudbからメタデータを取得するコマンドのインストール $ bash <(curl https://getcas.codenotary.io -L)
  2. alma-sbomの使い方 SBOMを生成 $ alma_sbom.py --file-format フォーマット \ --rpm-package-hash SHA256ハッシュ File

    format対応表 ↓形式  フォーマット → CycloneDX SPDX JSON cyclonedx-json spdx-json XML cyclonedx-xml spdx-xml YAML spdx-yaml tagvalue spdx-tagvalue
  3. デモのまとめ 1. kernelをダウンロード $ dnf download kernel 2. kernelパッケージのハッシュを取る $

    sha256sum kernel-5.14.0-284.25.1.el9_2.x86_64.rpm 3. SBOMを生成する(JSONを使ったSPDXフォーマット) $ ./alma_sbom.py --file-format spdx-json \ --rpm-package-hash 788afcb1d3fac9cba...
  4. spdx-json形式SBOMの例(肝心な箇所を抜粋) { "SPDXID": "SPDXRef-DOCUMENT", "creationInfo": { "created": "2023-08-29T17:15:48Z", "creators": [

    "Organization: AlmaLinux OS Foundation ([email protected])", "Tool: AlmaLinux Build System 0.1", "Tool: alma-sbom 0.0.1", "Tool: Community Attestation Service (CAS) 1.0.3", "Tool: spdx-tools 0.8" ] "dataLicense": "CC0-1.0", "name": "kernel-5.14.0-284.25.1.el9_2", "spdxVersion": "SPDX-2.3", "documentNamespace": "https://security.almalinux.org/spdx-kernel-5.14.0-284.25.1.el9_2-92899c49-a9f4-4e23-a7e9-88aecef29281", "packages": [ { "SPDXID": "SPDXRef-0", "annotations": [ { "annotationDate": "2023-08-29T17:15:48Z", "annotationType": "OTHER", "annotator": "Tool: alma-sbom 0.0.1", "comment": "almalinux:albs:build:source:gitURL=https://git.almalinux.org/rpms/kernel.git" }, { "annotationDate": "2023-08-29T17:15:48Z", "annotationType": "OTHER", "annotator": "Tool: alma-sbom 0.0.1", "comment": "almalinux:albs:build:source:gitCommit=51d9463cdf02fe04bad689227cbf102e07318fd2" } ], "externalRefs": [ { "referenceCategory": "SECURITY", "referenceLocator": "cpe:2.3:a:almalinux:kernel:5.14.0-284.25.1.el9_2:*:*:*:*:*:*:*", "referenceType": "cpe23Type" } ], "name": "kernel", "supplier": "Organization: AlmaLinux OS Foundation ([email protected])", "versionInfo": "5.14.0-284.25.1.el9_2" } ] }
  5. spdx-xml形式SBOMの例(肝心な箇所を抜粋) <?xml version="1.0" encoding="utf-8"?> <Document> <SPDXID>SPDXRef-DOCUMENT</SPDXID> <creationInfo> <created>2023-08-29T17:15:57Z</created> <creators>Organization: AlmaLinux

    OS Foundation ([email protected])</creators> <creators>Tool: AlmaLinux Build System 0.1</creators> <creators>Tool: alma-sbom 0.0.1</creators> <creators>Tool: Community Attestation Service (CAS) 1.0.3</creators> <creators>Tool: spdx-tools 0.8</creators> </creationInfo> <name>kernel-5.14.0-284.25.1.el9_2</name> <spdxVersion>SPDX-2.3</spdxVersion> <documentNamespace>https://security.almalinux.org/spdx-kernel-5.14.0-284.25.1.el9_2-d685158e-a82f-42ce-9ead-6217d3b93de3</documentNamespace> <packages> <annotations> <annotationDate>2023-08-29T17:15:57Z</annotationDate> <annotationType>OTHER</annotationType> <annotator>Tool: alma-sbom 0.0.1</annotator> <comment>almalinux:albs:build:source:gitURL=https://git.almalinux.org/rpms/kernel.git</comment> </annotations> <annotations> <annotationDate>2023-08-29T17:15:57Z</annotationDate> <annotationType>OTHER</annotationType> <annotator>Tool: alma-sbom 0.0.1</annotator> <comment>almalinux:albs:build:source:gitCommit=51d9463cdf02fe04bad689227cbf102e07318fd2</comment> </annotations> <externalRefs> <referenceCategory>SECURITY</referenceCategory> <referenceLocator>cpe:2.3:a:almalinux:kernel:5.14.0-284.25.1.el9_2:*:*:*:*:*:*:*</referenceLocator> <referenceType>cpe23Type</referenceType> </externalRefs> <name>kernel</name> <supplier>Organization: AlmaLinux OS Foundation ([email protected])</supplier> <versionInfo>5.14.0-284.25.1.el9_2</versionInfo> </packages> </Document>