SBOM

// CycloneDX SBOM 예제 (JSON 형식)
// https://cyclonedx.org/specification/overview/

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2024-01-15T10:30:00Z",
    "tools": [
      {
        "vendor": "anchore",
        "name": "syft",
        "version": "0.100.0"
      }
    ],
    "component": {
      "type": "application",
      "name": "my-web-app",
      "version": "2.1.0",
      "bom-ref": "my-web-app@2.1.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.18.2",
      "purl": "pkg:npm/express@4.18.2",
      "bom-ref": "express@4.18.2",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "externalReferences": [
        {
          "type": "website",
          "url": "https://expressjs.com/"
        },
        {
          "type": "vcs",
          "url": "https://github.com/expressjs/express"
        }
      ],
      "properties": [
        {
          "name": "cdx:npm:package:development",
          "value": "false"
        }
      ]
    },
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21",
      "bom-ref": "lodash@4.17.21",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "name": "axios",
      "version": "1.6.0",
      "purl": "pkg:npm/axios@1.6.0",
      "bom-ref": "axios@1.6.0",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "my-web-app@2.1.0",
      "dependsOn": [
        "express@4.18.2",
        "lodash@4.17.21",
        "axios@1.6.0"
      ]
    },
    {
      "ref": "express@4.18.2",
      "dependsOn": [
        "body-parser@1.20.2",
        "cookie@0.5.0"
      ]
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-12345",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/"
      },
      "ratings": [
        {
          "source": { "name": "NVD" },
          "score": 7.5,
          "severity": "high",
          "method": "CVSSv31"
        }
      ],
      "affects": [
        {
          "ref": "axios@1.6.0"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "detail": "해당 취약점은 프록시 기능에서 발생하며, 우리 애플리케이션에서는 프록시를 사용하지 않음"
      }
    }
  ]
}

# GitHub Actions - SBOM 생성 및 취약점 스캔 파이프라인

name: SBOM Generation and Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  sbom-and-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      # 1. Syft로 SBOM 생성
      - name: Generate SBOM with Syft
        uses: anchore/sbom-action@v0
        with:
          image: myapp:${{ github.sha }}
          format: cyclonedx-json
          output-file: sbom.json
          artifact-name: sbom.cyclonedx.json

      # 2. Grype로 취약점 스캔
      - name: Scan SBOM for vulnerabilities
        uses: anchore/scan-action@v3
        id: scan
        with:
          sbom: sbom.json
          fail-build: true
          severity-cutoff: high

      # 3. 취약점 보고서 업로드
      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

      # 4. SBOM을 릴리스 아티팩트로 저장
      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

---
# GitLab CI - SBOM 파이프라인

stages:
  - build
  - sbom
  - scan

variables:
  IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

build:
  stage: build
  script:
    - docker build -t $IMAGE_NAME .
    - docker push $IMAGE_NAME

generate-sbom:
  stage: sbom
  image: anchore/syft:latest
  script:
    - syft $IMAGE_NAME -o cyclonedx-json > sbom.json
    - syft $IMAGE_NAME -o spdx-json > sbom.spdx.json
  artifacts:
    paths:
      - sbom.json
      - sbom.spdx.json
    expire_in: 1 week

vulnerability-scan:
  stage: scan
  image: anchore/grype:latest
  needs: [generate-sbom]
  script:
    - grype sbom:sbom.json --fail-on high
  allow_failure: false

---
# Dependency-Track 연동 (SBOM 중앙 관리)

# SBOM을 Dependency-Track에 업로드
upload-to-dependency-track:
  stage: sbom
  script:
    - |
      curl -X POST "https://dtrack.example.com/api/v1/bom" \
        -H "X-Api-Key: $DEPENDENCY_TRACK_API_KEY" \
        -H "Content-Type: multipart/form-data" \
        -F "projectName=my-app" \
        -F "projectVersion=$CI_COMMIT_SHA" \
        -F "autoCreate=true" \
        -F "bom=@sbom.json"