åœéçãªéçºè åãã«ãããã³ããšã³ãã®ããã±ãŒãžç®¡çãç¹ã«äŸåé¢ä¿è§£æ±ºæŠç¥ãšéèŠãªã»ãã¥ãªãã£ãã©ã¯ãã£ã¹ã«çŠç¹ãåœãŠãå æ¬çãªã¬ã€ãã§ãã
ããã³ããšã³ãã®ããã±ãŒãžç®¡çïŒã°ããŒãã«ãªéçºç°å¢ã«ãããäŸåé¢ä¿è§£æ±ºãšã»ãã¥ãªãã£ã®æ¢æ±
仿¥ã®çžäºæ¥ç¶ãããWebéçºã®äžçã§ã¯ãããã³ããšã³ããããžã§ã¯ãããŒãããæ§ç¯ãããããšã¯ã»ãšãã©ãããŸããã代ããã«ãããã±ãŒãžãããŒãžã£ãŒãéããŠç®¡çãããããªãŒãã³ãœãŒã¹ã®ã©ã€ãã©ãªããã¬ãŒã ã¯ãŒã¯ã®åºå€§ãªãšã³ã·ã¹ãã ã«äŸåããŠããŸãããããã®ããŒã«ã¯çŸä»£ã®ããã³ããšã³ãéçºã®çåœç·ã§ãããè¿ éãªã€ãã¬ãŒã·ã§ã³ãšåŒ·åãªæ©èœãžã®ã¢ã¯ã»ã¹ãå¯èœã«ããŸãããããããã®äŸåé¢ä¿ã¯ãäž»ã«äŸåé¢ä¿è§£æ±ºãšã»ãã¥ãªãã£ã«é¢ããè€éãããããããŸããã°ããŒãã«ãªéçºè ã«ãšã£ãŠããããã®åŽé¢ãçè§£ããããšã¯ãå ç¢ã§ä¿¡é Œæ§ãé«ããå®å šãªã¢ããªã±ãŒã·ã§ã³ãæ§ç¯ããããã«æãéèŠã§ãã
åºç€ïŒããã³ããšã³ãã®ããã±ãŒãžç®¡çãšã¯äœãïŒ
æ žå¿ãèšãã°ãããã³ããšã³ãã®ããã±ãŒãžç®¡çãšã¯ãããã³ããšã³ããããžã§ã¯ããäŸåããå€éšã©ã€ãã©ãªãã¢ãžã¥ãŒã«ãã€ã³ã¹ããŒã«ãæŽæ°ãèšå®ã管çããããã«äœ¿çšãããã·ã¹ãã ãšããŒã«ãæããŸããJavaScriptãšã³ã·ã¹ãã ã§æãæ®åããŠããããã±ãŒãžãããŒãžã£ãŒã¯æ¬¡ã®ãšããã§ãïŒ
- npm (Node Package Manager): Node.jsã®ããã©ã«ãã®ããã±ãŒãžãããŒãžã£ãŒã§ãããæãåºã䜿çšãããæå€§ã®ããã±ãŒãžãªããžããªãæã£ãŠããŸãã
- Yarn: Facebookã«ãã£ãŠéçºãããYarnã¯ãnpmã®åæã®ããã©ãŒãã³ã¹ãšã»ãã¥ãªãã£ã«é¢ããããã€ãã®æžå¿µã«å¯ŸåŠããããã«äœãããŸãããæ±ºå®è«çãªã€ã³ã¹ããŒã«ããªãã©ã€ã³ãã£ãã·ã¥ãªã©ã®æ©èœãæäŸããŸãã
- pnpm (Performant npm): æ°ãããã¬ã€ã€ãŒã§ããpnpmã¯ãã³ã³ãã³ãã¢ãã¬ã¹å¯èœãªã¹ãã¢ãšäŸåé¢ä¿ã®ã·ã³ããªãã¯ãªã³ã¯ã䜿çšããããšã«ããããã£ã¹ã¯ã¹ããŒã¹ã®å¹çãšé«éãªã€ã³ã¹ããŒã«æéã«çŠç¹ãåœãŠãŠããŸãã
ãããã®ãããŒãžã£ãŒã¯ããããžã§ã¯ãã®äŸåé¢ä¿ãšãã®åžæããããŒãžã§ã³ããªã¹ãã¢ããããããã«ãæãäžè¬çã«ã¯package.jsonã®ãããªèšå®ãã¡ã€ã«ãå©çšããŸãããã®ãã¡ã€ã«ã¯èšèšå³ãšããŠæ©èœããããã±ãŒãžãããŒãžã£ãŒã«ã©ã®ããã±ãŒãžãååŸããŠã€ã³ã¹ããŒã«ããããäŒããŸãã
äŸåé¢ä¿è§£æ±ºã®èª²é¡
äŸåé¢ä¿è§£æ±ºãšã¯ãããã±ãŒãžãããŒãžã£ãŒãå¿ èŠãªãã¹ãŠã®ããã±ãŒãžãšãã®ãµãäŸåé¢ä¿ã®æ£ç¢ºãªããŒãžã§ã³ã決å®ããããã»ã¹ã§ããããã¯ããã€ãã®èŠå ã«ãããéåžžã«è€éã«ãªãå¯èœæ§ããããŸãïŒ
1. ã»ãã³ãã£ãã¯ããŒãžã§ãã³ã°ïŒSemVerïŒãšããŒãžã§ã³ç¯å²
ã»ãšãã©ã®JavaScriptããã±ãŒãžã¯ãããŒãžã§ã³çªå·ã®å²ãåœãŠãšã€ã³ã¯ãªã¡ã³ãã®æ¹æ³ãå®ãã仿§ã§ããã»ãã³ãã£ãã¯ããŒãžã§ãã³ã°ïŒSemVerïŒã«æºæ ããŠããŸããSemVerçªå·ã¯éåžžãMAJOR.MINOR.PATCHïŒäŸïŒ1.2.3ïŒãšããŠè¡šçŸãããŸãã
- MAJOR: äºææ§ã®ãªãAPIã®å€æŽã
- MINOR: åŸæ¹äºææ§ã®ããæ¹æ³ã§ã®æ©èœè¿œå ã
- PATCH: åŸæ¹äºææ§ã®ãããã°ä¿®æ£ã
package.jsonã§ã¯ãéçºè
ã¯æŽæ°ããã°ä¿®æ£ã蚱容ããããã«ãæ£ç¢ºãªããŒãžã§ã³ã§ã¯ãªãããŒãžã§ã³ç¯å²ãæå®ããããšããããããŸããäžè¬çãªç¯å²æå®åã¯æ¬¡ã®ãšããã§ãïŒ
- ãã£ã¬ãã (
^): æå®ãããã¡ãžã£ãŒããŒãžã§ã³ã倿Žããªããææ°ã®ãã€ããŒãŸãã¯ãããããŒãžã§ã³ãžã®æŽæ°ãèš±å¯ããŸãïŒäŸïŒ^1.2.3ã¯1.2.3ãã2.0.0æªæºã®ããŒãžã§ã³ãèš±å¯ïŒãããã¯npmãšYarnã®ããã©ã«ãã§ãã - ãã«ã (
~): ãã€ããŒããŒãžã§ã³ãæå®ãããŠããå Žåã¯ãããã¬ãã«ã®å€æŽããã¡ãžã£ãŒããŒãžã§ã³ã®ã¿ãæå®ãããŠããå Žåã¯ãã€ããŒã¬ãã«ã®å€æŽãèš±å¯ããŸãïŒäŸïŒ~1.2.3ã¯1.2.3ãã1.3.0æªæºã®ããŒãžã§ã³ãèš±å¯ïŒã - ä»¥äž (
>=) / ä»¥äž (<=): æç€ºçã«ç¯å²ãå®çŸ©ããŸãã - ã¯ã€ã«ãã«ãŒã (
*): ä»»æã®ããŒãžã§ã³ãèš±å¯ããŸãïŒãã£ãã«æšå¥šãããŸããïŒã
ã°ããŒãã«ãªæå³åãïŒ SemVerã¯æšæºã§ãããç¯å²ã®è§£éãšå®è£ ã¯ãããã±ãŒãžãããŒãžã£ãŒéããããã¯èšå®ãäžè²«ããŠããªãå Žåã«åãããã±ãŒãžãããŒãžã£ãŒã®ç°ãªãã€ã³ã¹ããŒã«éã§ããã埮åŠãªéããçããããããšããããŸããç°ãªãå°åã®éçºè ã¯ãã€ã³ã¿ãŒãããã®é床ãããã±ãŒãžã¬ãžã¹ããªãžã®ã¢ã¯ã»ã¹ãç°ãªãå ŽåãããããããäŸåé¢ä¿è§£æ±ºã®å®éã®çµæã«åœ±é¿ãäžããå¯èœæ§ããããŸãã
2. äŸåé¢ä¿ããªãŒ
ãããžã§ã¯ãã®äŸåé¢ä¿ã¯ããªãŒæ§é ã圢æããŸããããã±ãŒãžAãããã±ãŒãžBã«äŸåãããã®ããã±ãŒãžBãããã±ãŒãžCã«äŸåãããããããŸãããããã±ãŒãžDãããã±ãŒãžBã«äŸåãããããããŸãããããã±ãŒãžãããŒãžã£ãŒã¯ããã¹ãŠã®ããã±ãŒãžã®äºææ§ã®ããããŒãžã§ã³ãã€ã³ã¹ããŒã«ãããããã«ããã®ããªãŒå šäœãèµ°æ»ããªããã°ãªããŸããã
è¡çªã®åé¡ïŒ ããã±ãŒãžAãLibraryX@^1.0.0ãèŠæ±ããããã±ãŒãžDãLibraryX@^2.0.0ãèŠæ±ããå Žåãã©ããªãã§ããããïŒããã¯å€å
žçãªäŸåé¢ä¿ã®è¡çªã§ããããã±ãŒãžãããŒãžã£ãŒã¯ãLibraryXã®ã©ã®ããŒãžã§ã³ãã€ã³ã¹ããŒã«ãã¹ããæ±ºå®ããªããã°ãªããŸãããå€ãã®å Žåã解決æŠç¥ã¯äŸåé¢ä¿ããªãŒã®ã«ãŒãã«è¿ãããã±ãŒãžã«ãã£ãŠèŠæ±ãããããŒãžã§ã³ãåªå
ããŸãããããã¯å¿
ãããç°¡åã§ã¯ãªããéžæãããããŒãžã§ã³ããã¹ãŠã®äŸåããã±ãŒãžãšçã«äºææ§ããªãå Žåãäºæãã¬åäœãåŒãèµ·ããå¯èœæ§ããããŸãã
3. ããã¯ãã¡ã€ã«ïŒæ±ºå®è«çãªã€ã³ã¹ããŒã«ã®ä¿èšŒ
ããŒãžã§ã³ç¯å²ã®äºæž¬äžå¯èœæ§ã«å¯ŸåŠããããŒã ã®ãã¹ãŠã®éçºè ãšãã¹ãŠã®ãããã€ã¡ã³ãç°å¢ããŸã£ããåãäŸåé¢ä¿ã®ã»ããã䜿çšããããšãä¿èšŒããããã«ãããã±ãŒãžãããŒãžã£ãŒã¯ããã¯ãã¡ã€ã«ã䜿çšããŸãã
- npm:
package-lock.jsonã䜿çšããŸãã - Yarn:
yarn.lockã䜿çšããŸãã - pnpm:
pnpm-lock.yamlã䜿çšããŸãã
ãããã®ãã¡ã€ã«ã¯ããã¹ãŠã®æšç§»çãªäŸåé¢ä¿ãå«ããnode_modulesãã£ã¬ã¯ããªã«ã€ã³ã¹ããŒã«ããããã¹ãŠã®ããã±ãŒãžã®æ£ç¢ºãªããŒãžã§ã³ãèšé²ããŸããããã¯ãã¡ã€ã«ãååšããå Žåãããã±ãŒãžãããŒãžã£ãŒã¯ã»ãšãã©ã®ããã±ãŒãžã§ããŒãžã§ã³ç¯å²ã®è§£æ±ºããžãã¯ããã€ãã¹ããããã¯ãã¡ã€ã«ã«æå®ããããšããã«äŸåé¢ä¿ãã€ã³ã¹ããŒã«ããããšããŸããããã¯ä»¥äžã®ç¹ã§éåžžã«éèŠã§ãïŒ
- åçŸæ§ïŒ ãã«ããç°ãªããã·ã³ãæéã§äžè²«ããŠããããšãä¿èšŒããŸãã
- ã³ã©ãã¬ãŒã·ã§ã³ïŒ ç¹ã«ã°ããŒãã«ã«åæ£ããããŒã ã§ãç§ã®ãã·ã³ã§ã¯åããåé¡ã鲿¢ããŸãã
- ã»ãã¥ãªãã£ïŒ ã€ã³ã¹ããŒã«ãããããã±ãŒãžããŒãžã§ã³ãšæ¢ç¥ã®å®å šãªããŒãžã§ã³ãšã®ç §åã容æã«ããŸãã
ã°ããŒãã«ãªãã¹ããã©ã¯ãã£ã¹ïŒ å¿ ãããã¯ãã¡ã€ã«ãããŒãžã§ã³ç®¡çã·ã¹ãã ïŒäŸïŒGitïŒã«ã³ãããããŠãã ãããããã¯ãã°ããŒãã«ãªããŒã ã§äŸåé¢ä¿ã確å®ã«ç®¡çããããã®ãããããæãéèŠãªåäžã®ã¹ãããã§ãã
4. äŸåé¢ä¿ã®æŽæ°ãç¶æãã
äŸåé¢ä¿è§£æ±ºããã»ã¹ã¯ãæåã®ã€ã³ã¹ããŒã«ã§çµããã§ã¯ãããŸãããã©ã€ãã©ãªã¯é²åãããã°ãä¿®æ£ããæ°æ©èœãå°å ¥ããŸããããã©ãŒãã³ã¹ãã»ãã¥ãªãã£ãæ°æ©èœãžã®ã¢ã¯ã»ã¹ã®ããã«ã¯ãäŸåé¢ä¿ã宿çã«æŽæ°ããããšãäžå¯æ¬ ã§ãã
- npm outdated / npm update
- Yarn outdated / Yarn upgrade
- pnpm outdated / pnpm up
ããããäŸåé¢ä¿ã®æŽæ°ãç¹ã«ãã£ã¬ããç¯å²ã§ã®æŽæ°ã¯ãæ°ããªäŸåé¢ä¿è§£æ±ºã®ã©ãŠã³ããåŒãèµ·ãããç Žå£ç倿Žãç«¶åãå°å ¥ããå¯èœæ§ããããŸããããã§ãæ éãªãã¹ããšæ®µéçãªæŽæ°ãäžå¯æ¬ ã«ãªããŸãã
極ããŠéèŠãªè²¬åïŒããã³ããšã³ãããã±ãŒãžç®¡çã«ãããã»ãã¥ãªãã£
ããã³ããšã³ãéçºã®ãªãŒãã³ãœãŒã¹æ§ã¯åŒ·ã¿ã§ãããé倧ãªã»ãã¥ãªãã£äžã®èª²é¡ãæç€ºããŸããæªæã®ããæ»æè ã¯ã人æ°ã®ããããã±ãŒãžã䟵害ããããæªæã®ããã³ãŒããæ³šå ¥ããããæ¢ç¥ã®è匱æ§ãæªçšãããããå¯èœæ§ããããŸãã
1. è åšã®ç¶æ³ãçè§£ãã
ããã³ããšã³ãããã±ãŒãžç®¡çã«ãããäž»èŠãªã»ãã¥ãªãã£è åšã«ã¯ã以äžã®ãããªãã®ããããŸãïŒ
- æªæã®ããããã±ãŒãžïŒ ããŒã¿ãçãã ããæå·é貚ããã€ãã³ã°ããããã·ã¹ãã ã劚害ãããããããšãæå³çã«èšèšãããããã±ãŒãžããããã¯ã¿ã€ãã¹ã¯ã¯ããã£ã³ã°ïŒäººæ°ã®ããããã±ãŒãžã«äŒŒãååã®ããã±ãŒãžãç»é²ããïŒããæ£åœãªããã±ãŒãžãä¹ã£åãããšã«ãã£ãŠå°å ¥ãããå¯èœæ§ããããŸãã
- è匱ãªäŸåé¢ä¿ïŒ æ£åœãªããã±ãŒãžã«ãæ»æè ãæªçšã§ããã»ãã¥ãªãã£äžã®æ¬ é¥ïŒCVEïŒãå«ãŸããŠããå ŽåããããŸãããããã®è匱æ§ã¯ãããã±ãŒãžèªäœãŸãã¯ãã®äŸåé¢ä¿ã«ååšããå¯èœæ§ããããŸãã
- ãµãã©ã€ãã§ãŒã³æ»æïŒ ãããã¯ãœãããŠã§ã¢éçºã©ã€ããµã€ã¯ã«ãæšçãšãããããåºç¯ãªæ»æã§ãã人æ°ã®ããããã±ãŒãžã䟵害ããããšã¯ãæ°åãŸãã¯æ°çŸäžã®äžæµãããžã§ã¯ãã«åœ±é¿ãäžããå¯èœæ§ããããŸãã
- äŸåé¢ä¿ã®æ··ä¹±ïŒDependency ConfusionïŒïŒ æ»æè ããå éšããã±ãŒãžãšåãååã®æªæã®ããããã±ãŒãžãå ¬éã¬ãžã¹ããªã«å ¬éããå¯èœæ§ããããŸãããã«ãã·ã¹ãã ãããã±ãŒãžãããŒãžã£ãŒã誀ã£ãŠèšå®ãããŠããå Žåãæå³ãããã©ã€ããŒãããŒãžã§ã³ã®ä»£ããã«æªæã®ããå ¬éããŒãžã§ã³ãããŠã³ããŒãããŠããŸãå¯èœæ§ããããŸãã
è åšã®ã°ããŒãã«ãªåœ±é¿ïŒ åºã䜿çšãããŠããããã±ãŒãžã§çºèŠãããè匱æ§ã¯ãå³åº§ã«äžççãªåœ±é¿ãåãŒãã倧éžãè¶ããŠäŒæ¥ãå人ã䜿çšããã¢ããªã±ãŒã·ã§ã³ã«åœ±é¿ãäžããå¯èœæ§ããããŸããäŸãã°ãSolarWindsã®æ»æã¯ãçŽæ¥çã«ã¯ããã³ããšã³ãããã±ãŒãžã§ã¯ãããŸããã§ãããããµãã©ã€ãã§ãŒã³ã«ãããŠä¿¡é ŒãããŠãããœãããŠã§ã¢ã³ã³ããŒãã³ãã䟵害ããããšã®ç倧ãªåœ±é¿ã瀺ããŸããã
2. ã»ãã¥ãªãã£ã®ããã®ããŒã«ãšæŠç¥
幞ããªããšã«ããããã®ãªã¹ã¯ã軜æžããããã®å ç¢ãªããŒã«ãšæŠç¥ããããŸãïŒ
a) è匱æ§ã¹ãã£ã³
ã»ãšãã©ã®ããã±ãŒãžãããŒãžã£ãŒã¯ããããžã§ã¯ãã®äŸåé¢ä¿ã«æ¢ç¥ã®è匱æ§ããªããã¹ãã£ã³ããããã®çµã¿èŸŒã¿ããŒã«ãæäŸããŠããŸãïŒ
- npm audit: ã€ã³ã¹ããŒã«ãããäŸåé¢ä¿ã«å¯ŸããŠè匱æ§ãã§ãã¯ãå®è¡ããŸãããŸããäœæ·±å»åºŠã®è匱æ§ãèªåçã«ä¿®æ£ããããšè©Šã¿ãããšãã§ããŸãã
- Yarn audit: npm auditãšåæ§ã«ãè匱æ§ã¬ããŒããæäŸããŸãã
- npm-check-updates (ncu) / yarn-upgrade-interactive: äž»ã«æŽæ°çšã§ããããããã®ããŒã«ã¯å€ãããã±ãŒãžããã€ã©ã€ãããããšãã§ãããããã¯ãã°ãã°ã»ãã¥ãªãã£åæã®å¯Ÿè±¡ãšãªããŸãã
å®è·µçãªæŽå¯ïŒ CI/CDãã€ãã©ã€ã³ã§å®æçã«npm auditïŒãŸãã¯ä»ã®ãããŒãžã£ãŒã®åçã³ãã³ãïŒãå®è¡ããŠãã ãããã¯ãªãã£ã«ã«ããã³é«æ·±å»åºŠã®è匱æ§ã¯ããããã€ã¡ã³ãã®ãããã«ãŒãšããŠæ±ããŸãã
b) å®å šãªèšå®ãšããªã·ãŒ
- npmã®`.npmrc` / Yarnã®`.yarnrc.yml`: ãããã®èšå®ãã¡ã€ã«ã䜿çšãããšã峿 ŒãªSSLã®åŒ·å¶ãä¿¡é Œã§ããã¬ãžã¹ããªã®æå®ãªã©ãããªã·ãŒãèšå®ã§ããŸãã
- ãã©ã€ããŒãã¬ãžã¹ããªïŒ ãšã³ã¿ãŒãã©ã€ãºã¬ãã«ã®ã»ãã¥ãªãã£ã®ããã«ããã©ã€ããŒãããã±ãŒãžã¬ãžã¹ããªïŒäŸïŒnpm EnterpriseãArtifactoryãGitHub PackagesïŒã䜿çšããŠå éšããã±ãŒãžããã¹ãããä¿¡é Œã§ããå ¬éããã±ãŒãžããã©ãŒãªã³ã°ããããšãæ€èšããŠãã ãããããã«ãããå¶åŸ¡ãšåé¢ã®å±€ã远å ãããŸãã
- `package-lock.json`ãŸãã¯`yarn.lock`ã®èªåæŽæ°ã®ç¡å¹åïŒ ã€ã³ã¹ããŒã«äžã«ããã¯ãã¡ã€ã«ãå°éãããªãå Žåã«å€±æããããã«ããã±ãŒãžãããŒãžã£ãŒãèšå®ããäºæããªãããŒãžã§ã³ã®å€æŽãé²ããŸãã
c) éçºè ã®ããã®ãã¹ããã©ã¯ãã£ã¹
- ããã±ãŒãžã®åºæã«æ³šæããïŒ ä¿¡é Œã§ãããœãŒã¹ããã®ããã±ãŒãžã§ãè¯å¥œãªã³ãã¥ããã£ãµããŒããšã»ãã¥ãªãã£æèã®æŽå²ããããã®ãåªå ããŸãã
- äŸåé¢ä¿ãæå°éã«æããïŒ ãããžã§ã¯ãã®äŸåé¢ä¿ãå°ãªãã»ã©ãæ»æå¯Ÿè±¡é åã¯å°ãããªããŸããæªäœ¿çšã®ããã±ãŒãžã宿çã«ã¬ãã¥ãŒããŠåé€ããŸãã
- äŸåé¢ä¿ãïŒæ éã«ïŒåºå®ããïŒ ããã¯ãã¡ã€ã«ã¯äžå¯æ¬ ã§ãããç¹ã«ç¯å²æå®ãäžå®å®ããäºæããªãæŽæ°ãåŒãèµ·ãããŠããå Žåã«ãéèŠãªäŸåé¢ä¿ã®ç¹å®ã®ãååã«åå³ãããããŒãžã§ã³ãåºå®ããããšã§ããããªãä¿èšŒã®å±€ãæäŸã§ããŸãã
- äŸåé¢ä¿ãã§ãŒã³ãçè§£ããïŒ å®éã«äœãã€ã³ã¹ããŒã«ããŠããããçè§£ããããã«ãäŸåé¢ä¿ããªãŒãèŠèŠåããã®ã«åœ¹ç«ã€ããŒã«ïŒäŸïŒ
npm lsãyarn listïŒã䜿çšããŸãã - äŸåé¢ä¿ã宿çã«æŽæ°ããïŒ åè¿°ã®ããã«ãæ¢ç¥ã®è匱æ§ã«ããããåœãŠãããã«ã¯ããããããã³ãã€ããŒãªãªãŒã¹ã§ææ°ã®ç¶æ ãä¿ã€ããšãéèŠã§ããå¯èœãªéããã®ããã»ã¹ãèªååããŸãããåžžã«å ç¢ãªãã¹ããšãšãã«è¡ããŸãã
- CI/CDã§`npm ci`ãŸãã¯`yarn install --frozen-lockfile`ã䜿çšããïŒ ãããã®ã³ãã³ãã¯ãã€ã³ã¹ããŒã«ãããã¯ãã¡ã€ã«ã«å³å¯ã«åŸãããšãä¿èšŒãã誰ããããŒã«ã«ã§ãããã«ç°ãªãããŒãžã§ã³ãã€ã³ã¹ããŒã«ããŠããå Žåã«çºçããå¯èœæ§ã®ããåé¡ã鲿¢ããŸãã
3. é«åºŠãªã»ãã¥ãªãã£ã«é¢ããèæ ®äºé
å³ããã»ãã¥ãªãã£èŠä»¶ãæã€çµç¹ããèŠå¶ã®å³ããæ¥çã§æŽ»åããçµç¹ã®å Žåã¯ã以äžãæ€èšããŠãã ããïŒ
- ãœãããŠã§ã¢éšå衚 (SBOM): ããŒã«ã¯ãããžã§ã¯ãã®SBOMãçæã§ãããã¹ãŠã®ã³ã³ããŒãã³ããšãã®ããŒãžã§ã³ããªã¹ãã¢ããããŸããããã¯å€ãã®ã»ã¯ã¿ãŒã§èŠå¶èŠä»¶ã«ãªãã€ã€ãããŸãã
- éçè§£æã»ãã¥ãªãã£ãã¹ã (SAST) ãšåçè§£æã»ãã¥ãªãã£ãã¹ã (DAST): ãããã®ããŒã«ãéçºã¯ãŒã¯ãããŒã«çµ±åããŠãèªèº«ã®ã³ãŒããšäŸåé¢ä¿ã®ã³ãŒãã®è匱æ§ãç¹å®ããŸãã
- äŸåé¢ä¿ãã¡ã€ã¢ãŠã©ãŒã«ïŒ é倧ãªè匱æ§ãããããšãç¥ãããŠããããŸãã¯çµç¹ã®ã»ãã¥ãªãã£åºæºãæºãããªãããã±ãŒãžã®ã€ã³ã¹ããŒã«ãèªåçã«ãããã¯ããããªã·ãŒãå®è£ ããŸãã
ã°ããŒãã«ãªéçºã¯ãŒã¯ãããŒïŒåœå¢ãè¶ããäžè²«æ§
ç°ãªã倧éžããŸããã§äœæ¥ãã忣ããŒã ã«ãšã£ãŠãããã±ãŒãžç®¡çã®äžè²«æ§ãç¶æããããšã¯äžå¯æ¬ ã§ãïŒ
- äžå åãããèšå®ïŒ ãã¹ãŠã®ããŒã ã¡ã³ããŒãåãããã±ãŒãžãããŒãžã£ãŒã®ããŒãžã§ã³ãšèšå®ã䜿çšããããã«ããŸããããããæç¢ºã«ææžåããŸãã
- æšæºåããããã«ãç°å¢ïŒ ã³ã³ããåïŒäŸïŒDockerïŒã䜿çšããŠãéçºè ã®ããŒã«ã«ãã·ã³ããªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã«é¢ä¿ãªãããã¹ãŠã®äŸåé¢ä¿ãšããŒã«ãã«ãã»ã«åããäžè²«ãããã«ãç°å¢ãäœæããŸãã
- èªååãããäŸåé¢ä¿ç£æ»ïŒ
npm auditãŸãã¯åçã®ãã®ãCI/CDãã€ãã©ã€ã³ã«çµ±åããŠãè匱æ§ãæ¬çªç°å¢ã«å°éããåã«ãã£ããããŸãã - æç¢ºãªã³ãã¥ãã±ãŒã·ã§ã³ãã£ãã«ïŒ äŸåé¢ä¿ã®æŽæ°ãæœåšçãªç«¶åãã»ãã¥ãªãã£ã¢ããã€ã¶ãªã«ã€ããŠè°è«ããããã®æç¢ºãªã³ãã¥ãã±ãŒã·ã§ã³ãããã³ã«ã確ç«ããŸãã
çµè«
ããã³ããšã³ãã®ããã±ãŒãžç®¡çã¯ãçŸä»£ã®Webéçºã«ãããŠè€éã§ããäžå¯æ¬ ãªåŽé¢ã§ããããã¯ãã¡ã€ã«ã®ãããªããŒã«ãéããŠäŸåé¢ä¿è§£æ±ºãç¿åŸããããšã¯ãå®å®çã§åçŸå¯èœãªã¢ããªã±ãŒã·ã§ã³ãæ§ç¯ããããã«éåžžã«éèŠã§ããåæã«ãè匱æ§ã¹ãã£ã³ãå®å šãªèšå®ãéçºè ã®ãã¹ããã©ã¯ãã£ã¹ã掻çšããã»ãã¥ãªãã£ãžã®ç©æ¥µçãªã¢ãããŒãã¯ããããžã§ã¯ããšãŠãŒã¶ãŒãé²åããè åšããå®ãããã«è²ããªããã®ã§ãã
ããŒãžã§ãã³ã°ã®è€éããããã¯ãã¡ã€ã«ã®éèŠæ§ããããŠåžžã«ååšããã»ãã¥ãªãã£ãªã¹ã¯ãçè§£ããããšã§ãäžçäžã®éçºè ã¯ããå埩åããããå®å šã§ãå¹ççãªããã³ããšã³ãã¢ããªã±ãŒã·ã§ã³ãæ§ç¯ã§ããŸãããããã®ååãåãå ¥ããããšã§ãã°ããŒãã«ããŒã ã¯å¹æçã«ååãããŸããŸãçžäºæ¥ç¶ãããããžã¿ã«ç€ŸäŒã«ãããŠé«å質ãªãœãããŠã§ã¢ãæäŸã§ããããã«ãªããŸãã