供应链安全：SBOM、签名、验证

组件名称 (Component Name)
组件版本 (Component Version)
供应商 (Supplier)
唯一标识符 (Unique Identifier) - 如 PURL、CPE、SWHID
依赖关系 (Dependencies)
许可证 (License)
哈希值 (Hash) - SHA-256、SHA-512
来源信息 (Origin) - 下载地址、仓库地址

# 安装 Syft
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh

# 从容器镜像生成 SPDX 格式 SBOM
syft myapp:v1.0.0 -o spdx-json > sbom.spdx.json

# 从容器镜像生成 CycloneDX 格式 SBOM
syft myapp:v1.0.0 -o cyclonedx-json > sbom.cdx.json

# 从文件系统目录生成 SBOM
syft dir:./dist -o cyclonedx-json > sbom.cdx.json

# 将 SBOM 作为 OCI Artifact 推送到镜像仓库
syft myapp:v1.0.0 -o spdx-json | \
  cosign attach sbom --sbom - myapp:v1.0.0

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2024-01-15T10:30:00Z",
    "component": {
      "type": "container",
      "name": "myapp",
      "version": "v1.0.0",
      "purl": "pkg:oci/myapp@sha256:abc123?tag=v1.0.0"
    },
    "tools": [
      {
        "vendor": "anchore",
        "name": "syft",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/express@4.18.2",
      "type": "library",
      "name": "express",
      "version": "4.18.2",
      "purl": "pkg:npm/express@4.18.2",
      "supplier": {
        "name": "Express.js"
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "abc123..."
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/express@4.18.2",
      "dependsOn": [
        "pkg:npm/body-parser@1.20.1",
        "pkg:npm/cookie@0.5.0"
      ]
    }
  ]
}

# 安装 Cosign
brew install cosign  # macOS
# 或
go install github.com/sigstore/cosign/v2/cmd/cosign@latest

# ====== Keyless 签名（推荐）======
# 使用 OIDC 身份签名（无需管理密钥）
cosign sign --yes myregistry.io/myapp:v1.0.0

# 签名时附加注解
cosign sign --yes \
  --annotations "commit=abc123" \
  --annotations "workflow=build-123" \
  myregistry.io/myapp:v1.0.0

# ====== 密钥对签名（传统方式）======
# 生成密钥对
cosign generate-key-pair

# 使用私钥签名
COSIGN_PASSWORD=your-password cosign sign \
  --key cosign.key \
  myregistry.io/myapp:v1.0.0

# ====== 验证签名 ======
# Keyless 验证（验证签名存在且有效）
cosign verify myregistry.io/myapp:v1.0.0

# 验证特定身份签发的签名
cosign verify \
  --certificate-identity="github-actions[bot]" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  myregistry.io/myapp:v1.0.0

# 验证特定注解
cosign verify \
  --certificate-identity="github-actions[bot]" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --annotations="commit=abc123" \
  myregistry.io/myapp:v1.0.0

# 使用公钥验证
cosign verify \
  --key cosign.pub \
  myregistry.io/myapp:v1.0.0

# ====== SBOM 关联与验证 ======
# 附加 SBOM 到镜像
cosign attach sbom --sbom sbom.cdx.json myregistry.io/myapp:v1.0.0

# 对 SBOM 签名
cosign sign --attachment sbom --yes myregistry.io/myapp:v1.0.0

# 验证 SBOM 签名
cosign verify --attachment sbom myregistry.io/myapp:v1.0.0

# ====== Attestation（证明）======
# 创建 SLSA Provenance Attestation
cosign attest --yes \
  --predicate provenance.json \
  --type slsaprovenance \
  myregistry.io/myapp:v1.0.0

# 验证 Attestation
cosign verify-attestation \
  --type slsaprovenance \
  myregistry.io/myapp:v1.0.0

# .github/workflows/supply-chain-security.yml
name: Supply Chain Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  id-token: write  # OIDC token for Sigstore
  contents: read
  packages: write
  attestations: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-sign:
    name: Build, SBOM, Sign
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha
            type=ref,event=branch
            type=semver,pattern={{version}}

      # Step 1: 构建容器镜像
      - name: Build Container Image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          sbom: true
          provenance: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Step 2: 生成 SBOM
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
          format: cyclonedx-json
          output-file: sbom.cdx.json
          artifact-name: sbom.cdx.json

      # Step 3: 使用 Sigstore 签名镜像
      - name: Sign Image with Cosign
        uses: sigstore/cosign-installer@v3
      - run: |
          cosign sign --yes \
            --annotations "commit=${{ github.sha }}" \
            --annotations "workflow=${{ github.run_id }}" \
            --annotations "ref=${{ github.ref }}" \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

      # Step 4: 签名 SBOM
      - name: Sign SBOM
        run: |
          cosign sign --yes \
            --attachment sbom \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

      # Step 5: 生成 SLSA Provenance
      - name: Generate SLSA Provenance
        uses: actions/attest-slsa@v1
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      # Step 6: 漏洞扫描（基于 SBOM）
      - name: Scan SBOM for Vulnerabilities
        uses: anchore/scan-action@v3
        with:
          sbom: sbom.cdx.json
          fail-build: true
          severity-cutoff: high

  verify:
    name: Verify Signatures
    runs-on: ubuntu-latest
    needs: build-and-sign

    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Verify Image Signature
        run: |
          cosign verify \
            --certificate-identity="https://github.com/${{ github.repository }}/.github/workflows/supply-chain-security.yml@refs/heads/main" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-sign.outputs.digest }}

      - name: Verify SBOM Signature
        run: |
          cosign verify --attachment sbom \
            --certificate-identity="https://github.com/${{ github.repository }}/.github/workflows/supply-chain-security.yml@refs/heads/main" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-sign.outputs.digest }}

      - name: Verify SLSA Provenance
        uses: actions/attest-slsa@v1
        with:
          subject-digest: ${{ needs.build-and-sign.outputs.digest }}
          predicate-type: "https://slsa.dev/provenance/v1"
          verify: true

# kyverno-verify-image-signature.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
  annotations:
    policies.kyverno.io/title: Verify Image Signature
    policies.kyverno.io/description: |
      验证容器镜像是否由可信身份签名
spec:
  validationFailureAction: Enforce  # 强制执行，拒绝未签名镜像
  background: true
  rules:
    - name: verify-ghcr-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - production
                - staging
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/myorg/*"
                    issuer: "https://token.actions.githubusercontent.com"
          required: true

    - name: verify-sbom-attestation
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          attestations:
            - predicateType: "https://cyclonedx.org/bom"
              attestors:
                - entries:
                    - keyless:
                        subject: "https://github.com/myorg/*"
                        issuer: "https://token.actions.githubusercontent.com"
              required: true

# Dockerfile - 固定基础镜像版本（使用 digest）
FROM node:20.11.0-alpine3.19@sha256:abc123...def456

# 固定包管理器版本
RUN npm install -g pnpm@8.15.1

# 使用 lockfile 确保依赖版本固定
COPY pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

// package.json - 使用精确版本号（避免 ^ 或 ~）
{
  "dependencies": {
    "express": "4.18.2",
    "lodash": "4.17.21",
    "axios": "1.6.5"
  },
  "devDependencies": {
    "typescript": "5.3.3"
  }
}

# .github/dependabot.yml - 配置 Dependabot 自动更新
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    versioning-strategy: "increase-if-necessary"
    groups:
      production-dependencies:
        dependency-type: "production"
      development-dependencies:
        dependency-type: "development"

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"

依赖准入检查清单：
□ 是否有活跃维护？（最近 6 个月有更新）
□ 是否有安全漏洞历史？（查询 Snyk Vulnerability DB）
□ 许可证是否合规？（使用 SPDX 标识符）
□ 是否有替代方案？（优先选择更成熟的库）
□ 是否必需？（避免引入不必要的依赖）

# 查询特定镜像的签名记录
cosign triangulate myregistry.io/myapp:v1.0.0

# 从 Rekor 获取签名详情
rekor-cli get --uuid <uuid> --rekor_server https://rekor.sigstore.dev

# 监控特定身份的签名活动
rekor-cli search --email "ci-bot@example.com" \
  --rekor_server https://rekor.sigstore.dev