reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,137 @@
|
||||
# CI/CD 管道安全审计
|
||||
|
||||
## 管道攻击面
|
||||
|
||||
```text
|
||||
威胁模型（STRIDE）:
|
||||
□ 欺骗: 伪造构建/签名/来源
|
||||
□ 篡改: 修改源代码/构建产物/依赖
|
||||
□ 否认: 无审计日志的恶意操作
|
||||
□ 信息泄露: 管道日志/构建产物泄漏密钥
|
||||
□ 拒绝服务: 耗尽 CI 资源/破坏构建
|
||||
□ 权限提升: Runner 逃逸/密钥窃取
|
||||
```
|
||||
|
||||
## 审计清单
|
||||
|
||||
### 1. Pipeline as Code 配置
|
||||
|
||||
```yaml
|
||||
# GitHub Actions 审计要点
|
||||
# ❌ 危险模式
|
||||
on:
|
||||
pull_request_target: # 可访问 secrets 的 PR 触发
|
||||
types: [opened]
|
||||
|
||||
# ❌ 脚本注入
|
||||
- run: echo "${{ github.event.issue.title }}" # 用户输入 → shell
|
||||
|
||||
# ❌ 不受限的 token 权限
|
||||
permissions: write-all
|
||||
|
||||
# ✅ 安全模式
|
||||
on:
|
||||
pull_request: # 无 secrets 访问
|
||||
types: [opened]
|
||||
|
||||
# ✅ 固定到 SHA
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
|
||||
# ✅ 最小权限
|
||||
permissions:
|
||||
contents: read
|
||||
```
|
||||
|
||||
### 2. 密钥管理
|
||||
|
||||
```bash
|
||||
# 扫描历史提交中的密钥
|
||||
gitleaks detect --source . --verbose
|
||||
trufflehog git file://. --only-verified
|
||||
|
||||
# 检查 Actions Secrets 使用
|
||||
gh secret list
|
||||
# 确认: 无硬编码密钥、定期轮换、最小权限
|
||||
|
||||
# 运行时密钥注入
|
||||
# ✅ 使用 OIDC 替代长期密钥
|
||||
# ✅ Secrets 仅在需要时暴露到特定步骤
|
||||
```
|
||||
|
||||
### 3. 构建完整性
|
||||
|
||||
```bash
|
||||
# 构建溯源
|
||||
# 生成不可篡改的构建记录（SLSA L2+）
|
||||
slsa-provenance generate --source . --output provenance.json
|
||||
|
||||
# 产物签名
|
||||
cosign sign-blob --key cosign.key artifact.tar.gz
|
||||
|
||||
# 验证
|
||||
cosign verify-blob --key cosign.pub --signature artifact.tar.gz.sig artifact.tar.gz
|
||||
```
|
||||
|
||||
### 4. Runner 安全
|
||||
|
||||
```text
|
||||
□ 是否使用 GitHub-hosted runner？（推荐，每次全新环境）
|
||||
□ Self-hosted runner: 是否在隔离的 VM/容器中运行？
|
||||
□ 是否运行过 fork PR？（self-hosted runner 风险极高）
|
||||
□ Runner 是否有网络出站限制？
|
||||
□ 构建缓存是否可能跨构建泄漏？
|
||||
```
|
||||
|
||||
### 5. 依赖拉取安全
|
||||
|
||||
```text
|
||||
□ npm: package-lock.json 是否提交？ 禁止 --force / --legacy-peer-deps
|
||||
□ pip: requirements.txt 是否冻结版本？ 禁止 pip install <未验证来源>
|
||||
□ Docker: FROM 是否固定 digest？ 禁止 latest tag
|
||||
□ Go: go.sum 是否提交？
|
||||
□ 私有包: 注册表认证是否用短期 token？
|
||||
```
|
||||
|
||||
## 自动化检查 Pipeline
|
||||
|
||||
```yaml
|
||||
# .github/workflows/supply-chain.yml
|
||||
name: Supply Chain Security
|
||||
on: [push, pull_request]
|
||||
|
||||
jobs:
|
||||
sca:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: SBOM Generate
|
||||
run: |
|
||||
npm install -g @cyclonedx/cdxgen
|
||||
cdxgen -o sbom.json
|
||||
|
||||
- name: OSV Scan
|
||||
run: |
|
||||
go install github.com/google/osv-scanner/cmd/osv-scanner@latest
|
||||
osv-scanner scan --sbom sbom.json --format sarif > osv-results.sarif
|
||||
|
||||
- name: Trivy Scan
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: fs
|
||||
severity: CRITICAL,HIGH
|
||||
exit-code: 1
|
||||
|
||||
- name: Secret Scan
|
||||
run: |
|
||||
docker run --rm -v $PWD:/src ghcr.io/gitleaks/gitleaks:latest \
|
||||
detect --source /src --verbose
|
||||
|
||||
- name: Dependency-Track Upload
|
||||
run: |
|
||||
curl -X POST https://dtrack.example.com/api/v1/bom \
|
||||
-H "X-Api-Key: ${{ secrets.DTRACK_API_KEY }}" \
|
||||
-F "autoCreate=true" -F "project=myapp" -F "bom=@sbom.json"
|
||||
```
|
||||
|
||||
Source: SLSA Framework, OWASP CI/CD Top 10, GitHub Security Lab
|
||||
@@ -0,0 +1,74 @@
|
||||
# SBOM + SCA 方法论
|
||||
|
||||
## SBOM 标准对比
|
||||
|
||||
| 标准 | 格式 | 生态 | 推荐场景 |
|
||||
|------|------|------|---------|
|
||||
| SPDX | JSON/YAML/tag-value | Linux Foundation、Yocto | 许可证合规优先 |
|
||||
| CycloneDX | JSON/XML | OWASP、Kubernetes | 安全分析优先 |
|
||||
| SWID | XML | ISO 标准 | 企业资产管理 |
|
||||
|
||||
## SBOM 生成工具链
|
||||
|
||||
```bash
|
||||
# cdxgen: 从源码生成 CycloneDX SBOM
|
||||
cdxgen -o bom.json -t cyclonedx
|
||||
|
||||
# Syft: 从容器/文件系统生成
|
||||
syft nginx:latest -o spdx-json > sbom.spdx.json
|
||||
|
||||
# SBOM-Tool: 微软工具链
|
||||
sbom-tool generate -b ./build -bc ./src -pn MyApp -pv 1.0
|
||||
```
|
||||
|
||||
## SCA 工具对比
|
||||
|
||||
| 工具 | 免费 | 速度 | 数据库 | 可达性 |
|
||||
|------|:--:|------|--------|:--:|
|
||||
| OSV-Scanner | ✅ | 极快 | OSV.dev | ❌ |
|
||||
| Trivy | ✅ | 快 | 多源 | ❌ |
|
||||
| Dependency-Track | ✅ | 中 | NVD+OSV+GitHub | ❌ (需插件) |
|
||||
| Snyk | ❌ | 中 | 专有 | ✅ |
|
||||
| CodeQL | ✅ | 慢 | 代码级 | ✅ |
|
||||
|
||||
## 漏洞优先级策略
|
||||
|
||||
```
|
||||
CVSS ≥ 9.0 + 有公开 PoC + 可达 → P0 立即修复
|
||||
CVSS ≥ 7.0 + 有 PoC + 可达 → P1 本周修复
|
||||
CVSS ≥ 7.0 + 无 PoC 或不可达 → P2 下个迭代修复
|
||||
其余 → 按常规流程
|
||||
```
|
||||
|
||||
## 手工验证三步法
|
||||
|
||||
```bash
|
||||
# 1. 确认版本（不要盲信 SBOM 字段）
|
||||
# 容器内: dpkg -l | grep <package>
|
||||
# Node: cat node_modules/<pkg>/package.json | jq .version
|
||||
# Python: pip show <package>
|
||||
|
||||
# 2. 确认漏洞
|
||||
# 搜索 CVE: https://osv.dev / https://nvd.nist.gov
|
||||
# 查看受影响版本范围
|
||||
# 找到 GitHub Advisory / oss-security 邮件列表
|
||||
|
||||
# 3. 验证影响
|
||||
# 搜索公开 PoC: GitHub/Exploit-DB
|
||||
# 分析利用条件: 是否需要认证/本地访问/特定配置
|
||||
# 在隔离环境验证: docker run --rm -it vulnerable-image bash
|
||||
```
|
||||
|
||||
## 持续监控
|
||||
|
||||
```yaml
|
||||
# 每日 SBOM 更新 + 扫描
|
||||
schedule:
|
||||
- cron: "0 6 * * *" # 每天早上 6 点
|
||||
steps:
|
||||
- cdxgen -o bom.json
|
||||
- osv-scanner scan --sbom bom.json
|
||||
- trivy fs --exit-code 1 --severity CRITICAL .
|
||||
```
|
||||
|
||||
Source: OWASP CycloneDX, SPDX, Google OSV, CISA SBOM Guidance
|
||||
Reference in New Issue
Block a user