I-Trivy iyahlaselwa futhi: Izenzo ze-GitHub ezisabalele umaka izimfihlo zokuyekethisa

Iqhinga liyahlaselwa futhi: Izenzo ze-GitHub ezisabalele umaka izimfihlo zokuyekethisa

Ukuvikeleka kochungechunge lokunikezwa kwesofthiwe kunamandla njengesixhumanisi esibuthakathaka kakhulu. Emaqenjini amaningi okuthuthukisa, leso sixhumanisi sesibe yiwona kanye amathuluzi athembele kuwo ukuze bathole ubungozi. Ngokuphathelene nokushintshana kwemicimbi, i-Trivy, isithwebuli esidumile somthombo ovulekile esinakekelwa i-Aqua Security, izithole isenkabeni yokuhlasela okuyinkimbinkimbi. Abadlali abanonya bafake engcupheni umaka wenguqulo ethile (`v0.48.0`) ngaphakathi kwekhosombe layo le-GitHub Actions, bafaka ikhodi edizayinelwe ukweba izimfihlo ezibucayi kunoma yikuphi ukuhamba komsebenzi okusetshenzisiwe. Lesi sigameko siyisikhumbuzo esiqinile sokuthi ezinhlelweni zethu zentuthuko ezixhumene, ukwethembana kufanele kuqinisekiswe ngokuqhubekayo, kungacatshangwa.

I-Anatomy ye-Tag Compromise Attack

Lokhu bekungekona ukwephulwa kwekhodi yesicelo ewumongo ye-Trivy, kodwa ukuchithwa okuhlakaniphile kokuzenzakalela kwayo kwe-CI/CD. Abahlaseli baqondise ikhosombe le-GitHub Actions, bakha inguqulo enonya yefayela elithi `action.yml` kamaka `v0.48.0`. Uma ukugeleza komsebenzi kanjiniyela kubhekisela kulo maki othize, isenzo sizosebenzisa iskripthi esiyingozi ngaphambi kokusebenzisa iskeni esisemthethweni se-Trivy. Lesi skripthi senzelwe ukukhipha izimfihlo—njengamathokheni ekhosombe, izifakazelo zomhlinzeki wamafu, nokhiye be-API—kuseva eyirimothi elawulwa umhlaseli. Imvelo ecashile yalokhu kuhlasela ilele ekucaciseni kwakho; onjiniyela abasebenzisa omaka abaphephile okuthi `@v0.48` noma `@main` abazange bathinteke, kodwa labo abanamathisele umaka osengozini bengazi baveze ukuba sengozini okubalulekile epayipini labo.

Kungani Lesi Sehlo Sizwakala Kuwo Wonke Umhlaba We-DevOps

I-Trivy compromise ibalulekile ngezizathu ezimbalwa. Okokuqala, i-Trivy iyithuluzi lokuvikela eliyisisekelo elisetshenziswa izigidi ukuskena ubungozi ezitsheni kanye nekhodi. Ukuhlaselwa kwethuluzi lokuvikela kuqeda ukuthenjwa okuyisisekelo okudingekayo ekuthuthukisweni okuvikelekile. Okwesibili, igqamisa inkambiso ekhulayo yabahlaseli abahamba "phezulu nomfula," okuqondiswe kumathuluzi nokuncika enye isofthiwe eyakhelwe phezu kwayo. Ngokufaka ushevu engxenyeni eyodwa esetshenziswa kabanzi, bangakwazi ukufinyelela kunethiwekhi enkulu yamaphrojekthi nezinhlangano eziwela phansi. Lesi sigameko sisebenza njengesibonelo esibucayi ekuvikelekeni kwe-supply chain, okubonisa ukuthi alikho ithuluzi, kungakhathaliseki ukuthi linedumela elingakanani, eligonyelwe ukusetshenziswa njengesivikeli sokuhlasela.

"Lokhu kuhlasela kubonisa ukuqonda okuyinkimbinkimbi kokuziphatha konjiniyela kanye nemishini ye-CI/CD. Ukuphina umaka wenguqulo ethile kuvame ukubhekwa njengomkhuba ongcono kakhulu wokuzinza, kodwa lesi sigameko sibonisa ukuthi singase futhi sethule ingozi uma leyo nguqulo isengozini. Isifundo siwukuthi ukuphepha kuyinqubo eqhubekayo, hhayi ukusetha kwesikhathi esisodwa."

Izinyathelo Ezisheshayo Zokuvikela Izenzo Zakho Ze-GitHub

Emuva kwalesi sigameko, onjiniyela namaqembu ezokuphepha kumele bathathe izinyathelo zokuthi benze lukhuni ukugeleza komsebenzi wabo we-GitHub Actions. Ukuyekethisa kuyisitha sokuvikeleka. Nazi izinyathelo ezibalulekile okufanele uzisebenzise ngokushesha:

• Sebenzisa ukuphina kwe-SHA esikhundleni samathegi: Hlala ubhekisela ezenzweni ngokuzibophezela kwazo ngokugcwele (isb., `actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675`). Lena ukuphela kwendlela yokuqinisekisa ukuthi usebenzisa inguqulo yesenzo engaguquleki.
• Hlola ukugeleza komsebenzi wakho kwamanje: Hlola uhla lwemibhalo lwakho lwe-`.github/workflows`. Khomba noma yiziphi izenzo eziphiniwe komaka futhi uzishintshe ukuze wenze ama-SHA, ikakhulukazi kumathuluzi okuvikela abalulekile.
• Thuthukisa izici zokuphepha ze-GitHub: Nika amandla ukuhlolwa kwesimo esidingekayo futhi ubuyekeze ukulungiselelwa kokuthi `izimvume_zezimvume`, uzibeke kokufunda kuphela ngokuzenzakalela ukuze unciphise umonakalo ongaba khona ngenxa yesenzo esonakalisiwe.
• Qapha umsebenzi ongajwayelekile: Sebenzisa ukugawulwa kwemithi nokuqapha amapayipi akho e-CI/CD ukuze uthole uxhumo lwenethiwekhi oluphumayo olungalindelekile noma imizamo yokufinyelela engagunyaziwe usebenzisa izimfihlo zakho.

Ukwakha Isisekelo Esiqinile nge-Mewayz

Nakuba ukuvikela amathuluzi ngamanye kubalulekile, ukuqina kweqiniso kuvela endleleni ehlangene yokusebenza kwebhizinisi lakho. Izehlakalo ezifana ne-Trivy compromise ziveza ubunkimbinkimbi obufihliwe kanye nezingozi ezishumekwe kumaketanga amathuluzi esimanje. Inkundla efana ne-Mewayz ibhekana nalokhu ngokuhlinzeka nge-OS yebhizinisi ebumbene, eyimodulayo enciphisa ukusabalala kokuncika futhi imise ukulawula. Esikhundleni sokuhlanganisa izinsiza ezihlukene eziyishumi nambili—ngayinye inemodeli yayo yokuphepha kanye nomjikelezo wokubuyekeza—i-Mewayz ihlanganisa imisebenzi eyinhloko njengokuphathwa kwephrojekthi, i-CRM, nokuphathwa kwedokhumenti endaweni eyodwa, evikelekile. Lokhu kuqiniswa kunciphisa indawo yokuhlasela futhi kwenza ukuphatha kwezokuphepha kube lula, okuvumela amaqembu ukuthi agxile ezicini zokwakha kunokuba ahlale echibiyela ubungozi kusitaki sesofthiwe esihlukanisiwe. Emhlabeni lapho umaka owodwa osengozini ungaholela ekwephuleni umthetho okukhulu, ukuvikeleka okudidiyelwe kanye nokusebenza okulula okunikezwa yi-Mewayz kunikeza isisekelo esilawulwayo nesifundekayo sokukhula.