Back to Details

supply-chain-security

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Supply Chain Security Testing

Supply Chain Security Testing

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

  1. NOW
    : 读取 
    ../field-journal/precedent-pentest.md
    — 确认本 skill 的操作是已授权的常规操作
  2. NOW
    : 确认当前任务是否命中本 skill 的适用范围
  3. NEXT
    : 读取 
    ../tool-index.md
    ，校验工具可用性和实际路径
  4. NEXT
    : 缺工具时调用 bootstrap，不要猜路径
  5. ACT
    : 进入"工作流"第一步并执行，不要停在确认状态
SBOM / SCA / CI/CD 管道 / 依赖溯源 法规驱动：美国行政令 SBOM、中国国标、EU CRA
  1. NOW
    : Read 
    ../field-journal/precedent-pentest.md
    — Confirm that the operations of this skill are authorized routine actions
  2. NOW
    : Confirm whether the current task falls within the scope of application of this skill
  3. NEXT
    : Read 
    ../tool-index.md
    to verify tool availability and actual paths
  4. NEXT
    : Call bootstrap when tools are missing, do not guess paths
  5. ACT
    : Proceed to and execute the first step of the "Workflow", do not stay in the confirmation status
SBOM / SCA / CI/CD Pipelines / Dependency Provenance Regulation-driven: US Executive Order SBOM, China National Standard, EU CRA

适用场景

Applicable Scenarios

  • 软件供应链安全评估
  • 开源依赖漏洞扫描与验证
  • CI/CD 管道安全审计
  • 容器镜像安全分析
  • 第三方组件合规审查
  • 构建产物溯源与完整性验证
  • Software Supply Chain Security Assessment
  • Open Source Dependency Vulnerability Scanning and Verification
  • CI/CD Pipeline Security Audit
  • Container Image Security Analysis
  • Third-Party Component Compliance Review
  • Build Artifact Provenance and Integrity Verification

六层供应链治理框架

Six-Layer Supply Chain Governance Framework

text
Layer 1: 源码信任评估 → 上游仓库/维护者/发布历史审查
Layer 2: 构建管道集成 → CI/CD 安全门禁、签名验证
Layer 3: 制品分发完整性 → 签名、校验和、SBOM 附加
Layer 4: 运行时保护 → 容器扫描、准入控制
Layer 5: 持续监控 → CVE 实时追踪、漏洞可达性分析
Layer 6: 事件响应 → 供应链攻击应急、回滚策略
text
Layer 1: Source Code Trust Assessment → Review upstream repositories/maintainers/release history
Layer 2: Build Pipeline Integration → CI/CD security gates, signature verification
Layer 3: Artifact Distribution Integrity → Signatures, checksums, SBOM attachment
Layer 4: Runtime Protection → Container scanning, admission control
Layer 5: Continuous Monitoring → Real-time CVE tracking, vulnerability reachability analysis
Layer 6: Incident Response → Supply chain attack emergency response, rollback strategies

工作流

Workflow

1. SBOM 生成与审计

1. SBOM Generation and Audit

text
生成 SBOM：
□ CycloneDX 格式: cdxgen → bom.json
□ SPDX 格式: sbom-tool generate
□ Syft: syft <image|dir> -o spdx-json

审计要点：
□ 是否存在未知/未授权的依赖
□ 是否存在已废弃/停止维护的包
□ 许可证冲突检测
□ 直接依赖 vs 传递依赖清单
□ 每个组件的发布时间线和维护者状态
text
Generate SBOM:
□ CycloneDX format: cdxgen → bom.json
□ SPDX format: sbom-tool generate
□ Syft: syft <image|dir> -o spdx-json

Audit Key Points:
□ Are there unknown/unauthorized dependencies?
□ Are there abandoned/no-longer-maintained packages?
□ License conflict detection
□ Direct dependencies vs transitive dependencies list
□ Release timeline and maintainer status of each component

2. 软件组成分析（SCA）

2. Software Composition Analysis (SCA)

bash
undefined
bash
undefined

OSV-Scanner（免费、Google 维护）

OSV-Scanner (Free, maintained by Google)

osv-scanner scan -r . --format json
osv-scanner scan -r . --format json

OWASP Dependency-Track（企业级持续监控）

OWASP Dependency-Track (Enterprise-grade continuous monitoring)

docker run -p 8080:8080 dependencytrack/apiserver
docker run -p 8080:8080 dependencytrack/apiserver

→ 上传 SBOM → 自动匹配 NVD/OSV/GitHub Advisory

→ Upload SBOM → Automatically match NVD/OSV/GitHub Advisory

Snyk（商业）

Snyk (Commercial)

snyk test --all-projects snyk monitor # 持续监控
snyk test --all-projects snyk monitor # Continuous monitoring

Trivy（容器 + 依赖 + IaC）

Trivy (Container + Dependency + IaC)

trivy fs . # 文件系统扫描 trivy image nginx # 容器镜像 trivy config . # IaC 配置
undefined
trivy fs . # File system scanning trivy image nginx # Container image trivy config . # IaC configuration
undefined

3. 漏洞可达性验证

3. Vulnerability Reachability Verification

text
SCA 告警 ≠ 实际风险！大多数 SCA 工具只有 ~15% 的告警是实际可达的。

验证步骤：
1. 用 Dependency-Track 或 Trivy 获取 CVE 列表
2. 筛选 CVSS ≥ 7.0 的漏洞
3. 对有 PoC 的 CVE 做可达性分析
   - Code Property Graph 切片: 追踪用户输入到漏洞函数的路径
   - DEPTEX 方法: EPD (Execution Path Dominance) + LLM 语义验证
4. 在隔离环境中验证 PoC
5. 对可达的漏洞按实际影响排序修复优先级
工具参考：
  • CodeQL: GitHub 代码查询 → 数据流分析
  • Snyk Code: 可达性标记
  • DEPTEX: LLM 辅助上下文感知风险评估
text
SCA alerts ≠ actual risk! Most SCA tools have only ~15% of alerts that are actually reachable.

Verification Steps:
1. Obtain CVE list using Dependency-Track or Trivy
2. Filter vulnerabilities with CVSS ≥ 7.0
3. Conduct reachability analysis for CVEs with PoC
   - Code Property Graph slicing: Track path from user input to vulnerable function
   - DEPTEX method: EPD (Execution Path Dominance) + LLM semantic verification
4. Verify PoC in an isolated environment
5. Prioritize fixes for reachable vulnerabilities based on actual impact
Tool References:
  • CodeQL: GitHub code query → Data flow analysis
  • Snyk Code: Reachability marking
  • DEPTEX: LLM-assisted context-aware risk assessment

4. CI/CD 管道安全

4. CI/CD Pipeline Security

text
安全检查点：
□ 代码提交 → pre-commit hook: gitleaks (密钥扫描)
□ PR 阶段 → SCA 扫描 (Trivy/OSV-Scanner)
□ 构建阶段 → 制品签名 (cosign)
□ 推送阶段 → SBOM 附加 (syft + attest)
□ 部署阶段 → 准入控制 (OPA/Kyverno + 镜像扫描)
□ 运行时 → 持续漏洞监控 (Dependency-Track)

管道自身安全：
□ Pipeline as Code 审计（GitHub Actions / GitLab CI 配置注入）
□ Runner 隔离（防止恶意构建突破容器）
□ 密钥管理（Actions Secrets / Vault，禁止硬编码）
□ 第三方 Action 审查（锁定 commit SHA，非 tag）
text
Security Checkpoints:
□ Code submission → pre-commit hook: gitleaks (secret scanning)
□ PR phase → SCA scanning (Trivy/OSV-Scanner)
□ Build phase → Artifact signing (cosign)
□ Push phase → SBOM attachment (syft + attest)
□ Deployment phase → Admission control (OPA/Kyverno + image scanning)
□ Runtime → Continuous vulnerability monitoring (Dependency-Track)

Pipeline Own Security:
□ Pipeline as Code audit (GitHub Actions / GitLab CI configuration injection)
□ Runner isolation (Prevent malicious builds from breaking out of containers)
□ Secret management (Actions Secrets / Vault, prohibit hardcoding)
□ Third-party Action review (Lock commit SHA, not tag)

5. 容器镜像安全

5. Container Image Security

bash
undefined
bash
undefined

Dockerfile 审计

Dockerfile audit

hadolint Dockerfile
hadolint Dockerfile

镜像扫描（多层：OS + 应用依赖 + 配置）

Image scanning (Multi-layer: OS + application dependencies + configuration)

trivy image --severity HIGH,CRITICAL nginx:latest
trivy image --severity HIGH,CRITICAL nginx:latest

最小基础镜像

Minimal base image

优先: distroless → alpine → slim → 避免 latest

Priority: distroless → alpine → slim → Avoid latest

docker scout quickview nginx:latest
docker scout quickview nginx:latest

镜像签名

Image signing

cosign sign --key cosign.key myimage:tag cosign verify --key cosign.pub myimage:tag
undefined
cosign sign --key cosign.key myimage:tag cosign verify --key cosign.pub myimage:tag
undefined

6. 第三方依赖审查

6. Third-Party Dependency Review

text
新增依赖 Checklist：
□ 维护状态：最近 6 个月有提交？维护者活跃度？
□ 安全历史：过去有无被植入恶意代码？
□ 依赖树：引入后新增多少传递依赖？
□ 许可证：与项目许可证兼容？
□ 替代方案：有无更安全的替代（Snyk Advisor / Socket.dev 评分）？

风险评估矩阵：
  高维护 × 低依赖数 × 兼容许可证 → 低风险
  低维护 × 高依赖数 × 许可证冲突 → 高风险
text
New Dependency Checklist:
□ Maintenance status: Commits in the last 6 months? Maintainer activity?
□ Security history: Malicious code implants in the past?
□ Dependency tree: How many additional transitive dependencies are introduced?
□ License: Compatible with project license?
□ Alternatives: Are there safer alternatives (Snyk Advisor / Socket.dev ratings)?

Risk Assessment Matrix:
  High maintenance × Low dependency count × Compatible license → Low risk
  Low maintenance × High dependency count × License conflict → High risk

工具链

Toolchain

工具用途获取
OWASP Dependency-Track企业级持续 SCA
docker pull dependencytrack/apiserver
OSV-Scanner免费 SCA（OSV.dev 生态）
go install github.com/google/osv-scanner
Trivy镜像 + 依赖 + IaC 扫描
apt install trivy
SyftSBOM 生成
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh
cdxgenCycloneDX SBOM 生成
npm install -g @cyclonedx/cdxgen
Cosign容器签名
go install github.com/sigstore/cosign/v2/cmd/cosign
Gitleaks密钥/凭证扫描
go install github.com/gitleaks/gitleaks/v8
Snyk商业 SCA + 可达性
npm install -g snyk
CodeQL代码查询 + 数据流GitHub Actions 内置
ToolPurposeAcquisition
OWASP Dependency-TrackEnterprise-grade continuous SCA
docker pull dependencytrack/apiserver
OSV-ScannerFree SCA (OSV.dev ecosystem)
go install github.com/google/osv-scanner
TrivyImage + Dependency + IaC scanning
apt install trivy
SyftSBOM generation
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh
cdxgenCycloneDX SBOM generation
npm install -g @cyclonedx/cdxgen
CosignContainer signing
go install github.com/sigstore/cosign/v2/cmd/cosign
GitleaksSecret/credential scanning
go install github.com/gitleaks/gitleaks/v8
SnykCommercial SCA + Reachability
npm install -g snyk
CodeQLCode query + Data flowBuilt into GitHub Actions

参考

References

  • references/sbom-sca-methodology.md
    — SBOM + SCA 方法论
  • references/cicd-pipeline-security.md
    — CI/CD 管道安全审计
  • references/sbom-sca-methodology.md
    — SBOM + SCA Methodology
  • references/cicd-pipeline-security.md
    — CI/CD Pipeline Security Audit

任务完成自检（声称完成前 MUST 通过）

Task Completion Self-Check (MUST Pass Before Claiming Completion)

  • 我是否执行了工作流中的每一步（而不是只阅读）？
  • 我是否基于 
    tool-index
    使用了真实工具路径？
  • 我是否产出了可复现证据（命令/脚本/截图/报告）？
  • 我是否完成并回写了 RULES 要求的 Checklist 项？
  • Did I execute every step in the workflow (instead of just reading)?
  • Did I use real tool paths based on 
    tool-index
    ?
  • Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
  • Did I complete and write back the Checklist items required by RULES?