依赖管理：供应链安全与SBOM

package.json 直接依赖：
- express: ^4.18.0
- lodash: ^4.17.0
- axios: ^1.6.0
- winston: ^3.11.0

npm install 后的实际安装：
- 总包数：847
- 直接依赖：4
- 传递依赖：843
- 总代码量：约 150MB

#!/bin/bash
# generate-sbom.sh - 使用 Syft 生成 SBOM

set -euo pipefail

IMAGE_NAME="${1:-myapp:latest}"
OUTPUT_DIR="${2:-./sbom}"
FORMAT="${3:-cyclonedx-json}"

mkdir -p "$OUTPUT_DIR"

echo "=== 使用 Syft 生成 SBOM ==="
echo "目标: $IMAGE_NAME"
echo "格式: $FORMAT"
echo "输出目录: $OUTPUT_DIR"
echo ""

# 安装 Syft（如果未安装）
if ! command -v syft &> /dev/null; then
    echo "安装 Syft..."
    curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
fi

# 生成 CycloneDX JSON 格式的 SBOM
echo "生成 SBOM..."
syft "$IMAGE_NAME" \
    --output "$FORMAT" \
    --file "$OUTPUT_DIR/sbom.json"

# 同时生成 SPDX 格式（用于合规场景）
syft "$IMAGE_NAME" \
    --output spdx-json \
    --file "$OUTPUT_DIR/sbom-spdx.json"

# 生成人类可读的表格格式
syft "$IMAGE_NAME" \
    --output table \
    --file "$OUTPUT_DIR/sbom.txt"

echo ""
echo "=== SBOM 生成完成 ==="
echo "文件列表："
ls -la "$OUTPUT_DIR"

# 提取关键统计信息
echo ""
echo "=== SBOM 统计 ==="
jq '{
  total_components: (.components | length),
  licenses: [.components[].licenses[]?.license.id] | unique,
  suppliers: [.components[].publisher // "unknown"] | unique | length
}' "$OUTPUT_DIR/sbom.json"

#!/bin/bash
# scan-vulnerabilities.sh - 使用 Grype 扫描漏洞

set -euo pipefail

SBOM_FILE="${1:-./sbom/sbom.json}"
OUTPUT_DIR="${2:-./security-reports}"
SEVERITY_THRESHOLD="${3:-high}"  # negligible, low, medium, high, critical

mkdir -p "$OUTPUT_DIR"

echo "=== 使用 Grype 扫描漏洞 ==="
echo "SBOM 文件: $SBOM_FILE"
echo "严重性阈值: $SEVERITY_THRESHOLD"
echo ""

# 安装 Grype（如果未安装）
if ! command -v grype &> /dev/null; then
    echo "安装 Grype..."
    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
fi

# 执行漏洞扫描
echo "执行扫描..."
grype "sbom:$SBOM_FILE" \
    --output table \
    --output json \
    --file "$OUTPUT_DIR/vulnerability-report.json" \
    --severity "$SEVERITY_THRESHOLD" \
    --fail-on "$SEVERITY_THRESHOLD"

# 生成 SARIF 格式（用于 GitHub Code Scanning）
grype "sbom:$SBOM_FILE" \
    --output sarif \
    --file "$OUTPUT_DIR/vulnerability-report.sarif" \
    --severity "$SEVERITY_THRESHOLD"

echo ""
echo "=== 扫描完成 ==="

# 提取漏洞统计
echo ""
echo "=== 漏洞统计 ==="
jq '{
  total: (.matches | length),
  by_severity: (.matches | group_by(.vulnerability.severity) | map({key: .[0].vulnerability.severity, value: length}) | from_entries),
  critical_packages: [.matches[] | select(.vulnerability.severity == "Critical") | .artifact.name] | unique
}' "$OUTPUT_DIR/vulnerability-report.json"

# docker-compose.yml - Dependency-Track 部署配置
version: '3.8'

services:
  apiserver:
    image: dependencytrack/apiserver:latest
    container_name: dtrack-apiserver
    ports:
      - "8081:8080"
    environment:
      - ALPINE_DATABASE_MODE=external
      - ALPINE_DATABASE_URL=jdbc:postgresql://postgres:5432/dtrack
      - ALPINE_DATABASE_DRIVER=org.postgresql.Driver
      - ALPINE_DATABASE_USERNAME=dtrack
      - ALPINE_DATABASE_PASSWORD=${DTRACK_DB_PASSWORD:-dtrack}
      # 配置漏洞数据源
      - VULNERABILITY_SOURCES=NVD,OSV,GITHUB_ADVISORIES
      # 启用策略检查
      - POLICY_VIOLATION_ANALYZER_ENABLED=true
    volumes:
      - dtrack-data:/data
    depends_on:
      - postgres
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/version"]
      interval: 30s
      timeout: 10s
      retries: 3

  frontend:
    image: dependencytrack/frontend:latest
    container_name: dtrack-frontend
    ports:
      - "8080:8080"
    environment:
      - API_BASE_URL=http://apiserver:8080
    depends_on:
      - apiserver
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    container_name: dtrack-postgres
    environment:
      - POSTGRES_DB=dtrack
      - POSTGRES_USER=dtrack
      - POSTGRES_PASSWORD=${DTRACK_DB_PASSWORD:-dtrack}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U dtrack"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  dtrack-data:
  postgres-data:

# .github/workflows/sbom-security.yml
# SBOM 生成与供应链安全检查工作流

name: SBOM & Supply Chain Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # 每周定时扫描，检测新披露的漏洞
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write
  packages: write

jobs:
  generate-sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    outputs:
      sbom-file: ${{ steps.syft.outputs.sbom }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@v0
        with:
          syft-version: latest

      - name: Generate SBOM from directory
        id: syft
        uses: anchore/sbom-action@v0
        with:
          artifact-type: directory
          path: .
          format: cyclonedx-json
          output-file: sbom.json

      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json
          retention-days: 90

  scan-vulnerabilities:
    name: Scan Vulnerabilities
    needs: generate-sbom
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download SBOM
        uses: actions/download-artifact@v4
        with:
          name: sbom

      - name: Install Grype
        uses: anchore/scan-action/download-grype@v3
        with:
          grype-version: latest

      - name: Scan SBOM for vulnerabilities
        id: scan
        uses: anchore/scan-action@v3
        with:
          sbom: sbom.json
          severity-cutoff: high
          fail-build: true
          output-format: sarif

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif
          category: dependency-vulnerabilities

      - name: Generate vulnerability report
        if: always()
        run: |
          echo "## Vulnerability Scan Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          grype sbom:sbom.json --output table >> $GITHUB_STEP_SUMMARY || true

  scan-licenses:
    name: License Compliance Check
    needs: generate-sbom
    runs-on: ubuntu-latest
    steps:
      - name: Download SBOM
        uses: actions/download-artifact@v4
        with:
          name: sbom

      - name: Check license compliance
        run: |
          # 定义不允许的许可证列表
          DENIED_LICENSES="GPL-3.0|AGPL-3.0|SSPL-1.0|BSL-1.1"

          echo "## License Compliance Report" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # 提取所有许可证
          LICENSES=$(jq -r '.components[].licenses[]?.license.id // "NOASSERTION"' sbom.json | sort | uniq -c | sort -rn)

          echo "### License Distribution" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          echo "$LICENSES" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

          # 检查是否有不允许的许可证
          VIOLATIONS=$(jq -r --arg denied "$DENIED_LICENSES" '
            .components[] |
            select(.licenses[]?.license.id | test($denied)) |
            "\(.name) (\(.version)): \(.licenses[]?.license.id)"
          ' sbom.json || true)

          if [ -n "$VIOLATIONS" ]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### ⚠️ License Violations Detected" >> $GITHUB_STEP_SUMMARY
            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
            echo "$VIOLATIONS" >> $GITHUB_STEP_SUMMARY
            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
            exit 1
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "✅ No license violations detected" >> $GITHUB_STEP_SUMMARY

  upload-to-dependency-track:
    name: Upload to Dependency-Track
    needs: generate-sbom
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Download SBOM
        uses: actions/download-artifact@v4
        with:
          name: sbom

      - name: Upload SBOM to Dependency-Track
        run: |
          PROJECT_NAME="${{ github.repository }}"
          PROJECT_VERSION="${{ github.sha }}"

          # 创建或获取项目
          PROJECT_UUID=$(curl -s -X PUT \
            "${{ secrets.DTRACK_URL }}/api/v1/project" \
            -H "X-Api-Key: ${{ secrets.DTRACK_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d "{\"name\": \"${PROJECT_NAME}\", \"version\": \"${PROJECT_VERSION}\"}" | jq -r '.uuid')

          # 上传 SBOM
          curl -X PUT \
            "${{ secrets.DTRACK_URL }}/api/v1/bom" \
            -H "X-Api-Key: ${{ secrets.DTRACK_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d "{\"project\": \"${PROJECT_UUID}\", \"bom\": \"$(cat sbom.json | base64 -w 0)\"}"

          echo "SBOM uploaded to Dependency-Track"
          echo "Project UUID: ${PROJECT_UUID}"

  provenance-attestation:
    name: Generate SLSA Provenance
    needs: generate-sbom
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download SBOM
        uses: actions/download-artifact@v4
        with:
          name: sbom

      - name: Generate SLSA provenance
        uses: actions/attest-sbom@v1
        with:
          subject-name: ${{ github.repository }}
          subject-digest: sha256:${{ github.sha }}
          sbom-path: sbom.json
          push-to-registry: false

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "vulnerabilities": [
    {
      "id": "CVE-2024-28849",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28849"
      },
      "ratings": [
        {
          "source": {
            "name": "NVD"
          },
          "severity": "high",
          "score": 7.5,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "vulnerable_code_not_in_execute_path",
        "detail": "follow-redirects 的受影响功能（followRedirects with custom protocols）在本应用中未使用，配置已禁用该功能",
        "responses": ["will_not_fix", "update_not_available"]
      },
      "affects": [
        {
          "ref": "urn:cdx:myapp/1.0.0#pkg:npm/follow-redirects@1.15.0",
          "versions": [
            {
              "version": "1.15.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ]
}

# Dockerfile 中嵌入 SBOM 注解
LABEL org.opencontainers.image.authors="team@example.com"
LABEL org.opencontainers.image.documentation="https://docs.example.com"
LABEL org.opencontainers.image.sbom="sbom.json"

#!/bin/bash
# measure-supply-chain-metrics.sh
# 采集供应链安全度量指标

SBOM_FILE="${1:-./sbom/sbom.json}"
VULN_FILE="${2:-./security-reports/vulnerability-report.json}"

echo "=== 供应链安全度量报告 ==="
echo ""

# 1. SBOM 覆盖率（假设当前项目有 SBOM）
echo "--- 1. SBOM 覆盖率 ---"
if [ -f "$SBOM_FILE" ]; then
    echo "  ✅ 当前版本有 SBOM"
    COMPONENT_COUNT=$(jq '.components | length' "$SBOM_FILE")
    echo "  组件数量: $COMPONENT_COUNT"
else
    echo "  ❌ 当前版本无 SBOM"
fi

# 2. 依赖新鲜度
echo ""
echo "--- 2. 依赖新鲜度 ---"
if command -v npm &> /dev/null && [ -f "package.json" ]; then
    OUTDATED=$(npm outdated --json 2>/dev/null || echo "{}")
    OUTDATED_COUNT=$(echo "$OUTDATED" | jq 'keys | length')
    TOTAL_DEPS=$(jq '.dependencies + .devDependencies | keys | length' package.json)
    FRESHNESS=$(echo "scale=2; ($TOTAL_DEPS - $OUTDATED_COUNT) * 100 / $TOTAL_DEPS" | bc 2>/dev/null || echo "N/A")
    echo "  总依赖数: $TOTAL_DEPS"
    echo "  过期依赖数: $OUTDATED_COUNT"
    echo "  新鲜度: ${FRESHNESS}%"
fi

# 3. 漏洞统计
echo ""
echo "--- 3. 漏洞统计 ---"
if [ -f "$VULN_FILE" ]; then
    TOTAL_VULNS=$(jq '.matches | length' "$VULN_FILE")
    CRITICAL=$(jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length' "$VULN_FILE")
    HIGH=$(jq '[.matches[] | select(.vulnerability.severity == "High")] | length' "$VULN_FILE")
    MEDIUM=$(jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length' "$VULN_FILE")
    LOW=$(jq '[.matches[] | select(.vulnerability.severity == "Low")] | length' "$VULN_FILE")

    echo "  总漏洞数: $TOTAL_VULNS"
    echo "  - Critical: $CRITICAL"
    echo "  - High: $HIGH"
    echo "  - Medium: $MEDIUM"
    echo "  - Low: $LOW"
else
    echo "  未找到漏洞报告文件"
fi

# 4. 许可证分布
echo ""
echo "--- 4. 许可证分布 ---"
if [ -f "$SBOM_FILE" ]; then
    jq -r '.components[].licenses[]?.license.id // "NOASSERTION"' "$SBOM_FILE" | \
        sort | uniq -c | sort -rn | head -10
fi

# 5. 传递依赖深度
echo ""
echo "--- 5. 依赖深度分析 ---"
if [ -f "$SBOM_FILE" ]; then
    DIRECT_DEPS=$(jq '[.components[] | select(.scope == "required")] | length' "$SBOM_FILE" 2>/dev/null || echo "N/A")
    TRANSITIVE_DEPS=$(jq '[.components[] | select(.scope == "excluded")] | length' "$SBOM_FILE" 2>/dev/null || echo "N/A")
    echo "  直接依赖: $DIRECT_DEPS"
    echo "  传递依赖: $TRANSITIVE_DEPS"
fi

echo ""
echo "=== 报告结束 ==="