# インストール
# macOS
brew install cosign
 
# Linux
curl -L https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
  -o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign
 
# バージョン確認
cosign version
 
# 鍵ペア生成 (Key-pair 方式)
cosign generate-key-pair
# -> cosign.key (秘密鍵、パスワード保護)
# -> cosign.pub (公開鍵、配布用)
 
# KMS を使う場合
cosign generate-key-pair --kms awskms:///alias/cosign-key
cosign generate-key-pair --kms gcpkms://projects/myproject/locations/global/keyRings/myring/cryptoKeys/mykey
cosign generate-key-pair --kms azurekms://myvault.vault.azure.net/keys/mykey
 
# Kubernetes Secret に鍵を保存
cosign generate-key-pair k8s://production/cosign-key

# イメージのビルドとプッシュ
docker build -t ghcr.io/myorg/myapp:1.0.0 .
docker push ghcr.io/myorg/myapp:1.0.0
 
# ダイジェストを取得 (タグではなくダイジェストで署名)
DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/myorg/myapp:1.0.0)
echo $DIGEST
# -> ghcr.io/myorg/myapp@sha256:abc123...
 
# Key-pair 方式で署名
cosign sign --key cosign.key $DIGEST
 
# Keyless 方式で署名 (推奨、CI/CD 向け)
cosign sign --yes $DIGEST
 
# カスタムアノテーション付きで署名
cosign sign --yes \
  -a "commit=$(git rev-parse HEAD)" \
  -a "build-url=https://github.com/myorg/myapp/actions/runs/12345" \
  -a "build-date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  $DIGEST
 
# 検証 (Key-pair)
cosign verify --key cosign.pub ghcr.io/myorg/myapp:1.0.0
 
# 検証 (Keyless)
cosign verify \
  --certificate-identity="https://github.com/myorg/myapp/.github/workflows/build.yml@refs/tags/v1.0.0" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/myorg/myapp:1.0.0
 
# 検証 (正規表現でマッチ)
cosign verify \
  --certificate-identity-regexp="https://github.com/myorg/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/myorg/myapp:1.0.0
 
# 署名の詳細表示
cosign tree ghcr.io/myorg/myapp:1.0.0

# .github/workflows/build-sign.yml
name: Build and Sign
 
on:
  push:
    tags: ['v*']
 
permissions:
  contents: read
  packages: write
  id-token: write    # Keyless 署名に必要
 
jobs:
  build-and-sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=sha
 
      - uses: docker/build-push-action@v5
        id: build
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
 
      - uses: sigstore/cosign-installer@v3
 
      # Keyless 署名 (OIDC トークンベース)
      - name: Sign image
        run: |
          cosign sign --yes \
            -a "commit=${{ github.sha }}" \
            -a "ref=${{ github.ref }}" \
            -a "workflow=${{ github.workflow }}" \
            -a "run-id=${{ github.run_id }}" \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
 
      # SBOM を生成して添付
      - name: Generate and attach SBOM
        run: |
          # Trivy で SBOM 生成
          trivy image --format spdx-json \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }} \
            > sbom.spdx.json
 
          # SBOM をイメージに添付
          cosign attach sbom \
            --sbom sbom.spdx.json \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
 
          # SBOM 自体にも署名
          cosign sign --yes \
            --attachment sbom \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
 
      # Attestation の添付 (カスタムメタデータ)
      - name: Attest build
        run: |
          cosign attest --yes \
            --type custom \
            --predicate <(cat <<EOF
          {
            "buildType": "github-actions",
            "builder": {
              "id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
            },
            "metadata": {
              "buildStartedOn": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
              "completeness": {
                "parameters": true,
                "environment": true,
                "materials": true
              }
            }
          }
          EOF
          ) \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
 
      # 検証ステップ (確認)
      - name: Verify signature
        run: |
          cosign verify \
            --certificate-identity-regexp="https://github.com/${{ github.repository }}/.*" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}

# .gitlab-ci.yml
build-and-sign:
  stage: build
  image: docker:24
  services:
    - docker:24-dind
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  variables:
    IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
  script:
    - docker build -t $IMAGE .
    - docker push $IMAGE
    - DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' $IMAGE)
    # cosign のインストール
    - apk add --no-cache cosign
    # Keyless 署名 (GitLab OIDC トークンを使用)
    - cosign sign --yes $DIGEST
  rules:
    - if: $CI_COMMIT_TAG

# Trivy で SBOM 生成 (SPDX 形式)
trivy image --format spdx-json --output sbom-spdx.json myapp:latest
 
# Trivy で SBOM 生成 (CycloneDX 形式)
trivy image --format cyclonedx --output sbom-cdx.json myapp:latest
 
# Syft で SBOM 生成 (Anchore 製)
syft myapp:latest -o spdx-json > sbom-syft-spdx.json
syft myapp:latest -o cyclonedx-json > sbom-syft-cdx.json
 
# Syft で特定のスコープを指定
syft myapp:latest -o spdx-json --scope all-layers > sbom-all-layers.json
 
# Docker Scout (Docker Desktop 統合)
docker scout sbom myapp:latest
docker scout sbom --format spdx myapp:latest
 
# BuildKit で SBOM を自動生成
docker buildx build --sbom=true -t myapp:latest .
 
# ローカルディレクトリから SBOM 生成
syft dir:. -o cyclonedx-json > sbom-source.json
trivy fs --format spdx-json --output sbom-fs.json .

# SBOM を入力として脆弱性スキャン
trivy sbom sbom-spdx.json
 
# 重大度でフィルタ
trivy sbom --severity CRITICAL,HIGH sbom-spdx.json
 
# JSON 出力
trivy sbom --format json --output vuln-results.json sbom-spdx.json
 
# grype で SBOM スキャン
grype sbom:sbom-cdx.json
 
# grype で重大度フィルタ
grype sbom:sbom-cdx.json --fail-on critical
 
# ライセンスコンプライアンスチェック
trivy sbom --scanners license sbom-spdx.json
 
# 特定のライセンスを検出
trivy sbom --scanners license --severity HIGH sbom-spdx.json

# .github/workflows/sbom-management.yml
name: SBOM Management
 
on:
  push:
    branches: [main]
  schedule:
    # 毎日再スキャン (新しい CVE の検出)
    - cron: '0 6 * * *'
 
jobs:
  generate-sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Generate SBOM
        run: |
          # SPDX 形式
          trivy image --format spdx-json \
            --output sbom-spdx.json \
            ghcr.io/${{ github.repository }}:latest
 
          # CycloneDX 形式
          trivy image --format cyclonedx \
            --output sbom-cdx.json \
            ghcr.io/${{ github.repository }}:latest
 
      - name: Scan SBOM for vulnerabilities
        run: |
          trivy sbom --severity CRITICAL,HIGH \
            --exit-code 1 \
            sbom-spdx.json
 
      - name: Check licenses
        run: |
          trivy sbom --scanners license \
            --severity HIGH \
            sbom-spdx.json
 
      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: |
            sbom-spdx.json
            sbom-cdx.json
          retention-days: 90
 
      - name: Attach SBOM to release
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        run: |
          gh release upload ${{ github.ref_name }} \
            sbom-spdx.json \
            sbom-cdx.json
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://myorg.example.com/vex/2025-01-15",
  "author": "security-team@example.com",
  "timestamp": "2025-01-15T10:00:00Z",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2024-12345",
        "name": "CVE-2024-12345",
        "description": "OpenSSL DTLS vulnerability"
      },
      "products": [
        {
          "@id": "pkg:oci/myapp@sha256:abc123",
          "subcomponents": [
            {"@id": "pkg:apk/alpine/openssl@3.1.4"}
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "This application does not use DTLS. The vulnerable code path is never executed."
    },
    {
      "vulnerability": {
        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2024-67890",
        "name": "CVE-2024-67890"
      },
      "products": [
        {"@id": "pkg:oci/myapp@sha256:abc123"}
      ],
      "status": "affected",
      "action_statement": "Update to express@4.19.0 which contains the fix.",
      "action_statement_timestamp": "2025-01-20T00:00:00Z"
    }
  ]
}

# VEX ファイルを使ったスキャン
trivy image --vex vex.json myapp:latest
 
# VEX で "not_affected" とされた CVE はスキャン結果から除外される
# -> ノイズが減り、本当に対応すべき脆弱性に集中できる

# .github/workflows/slsa-build.yml
name: SLSA Build
 
on:
  push:
    tags: ['v*']
 
permissions:
  contents: read
  packages: write
  id-token: write
 
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
 
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      # BuildKit の Provenance 生成を有効化
      - uses: docker/build-push-action@v5
        id: build
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }}
          provenance: true     # SLSA Provenance を自動生成
          sbom: true           # SBOM を自動生成
 
      - uses: sigstore/cosign-installer@v3
 
      - name: Sign with cosign
        run: |
          cosign sign --yes \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
 
      # Provenance の検証
      - name: Verify provenance
        run: |
          cosign verify-attestation \
            --type slsaprovenance \
            --certificate-identity-regexp="https://github.com/${{ github.repository }}/" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}

# .github/workflows/slsa-generator.yml
name: SLSA Level 3 Build
 
on:
  push:
    tags: ['v*']
 
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.build.outputs.image }}
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: build
        run: |
          IMAGE=ghcr.io/${{ github.repository }}:${{ github.ref_name }}
          docker build -t $IMAGE .
          docker push $IMAGE
          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' $IMAGE | cut -d@ -f2)
          echo "image=$IMAGE" >> $GITHUB_OUTPUT
          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
 
  # SLSA Generator で Level 3 の Provenance を生成
  provenance:
    needs: build
    permissions:
      actions: read
      id-token: write
      packages: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
    with:
      image: ${{ needs.build.outputs.image }}
      digest: ${{ needs.build.outputs.digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

# in-toto: 各ビルドステップの証明を生成
# Step 1: ソースコードのチェックアウト
in-toto-run --step-name checkout \
  --products src/ \
  --signing-key developer.key \
  -- git clone https://github.com/myorg/myapp.git src/
 
# Step 2: テスト
in-toto-run --step-name test \
  --materials src/ \
  --signing-key ci.key \
  -- cd src && npm test
 
# Step 3: ビルド
in-toto-run --step-name build \
  --materials src/ \
  --products dist/ \
  --signing-key ci.key \
  -- cd src && npm run build
 
# レイアウト (ポリシー) の検証
in-toto-verify --layout root.layout \
  --layout-key owner.pub \
  --verification-keys developer.pub ci.pub

# npm: package-lock.json
npm ci  # lockfile に厳密に従ってインストール (npm install は使わない)
 
# pnpm: pnpm-lock.yaml
pnpm install --frozen-lockfile
 
# yarn: yarn.lock
yarn install --frozen-lockfile
 
# pip: requirements.txt (ハッシュ付き)
pip install --require-hashes -r requirements.txt
 
# Go: go.sum
go mod verify

# requirements.txt (ハッシュ付き - 改ざん検出)
flask==3.0.0 \
    --hash=sha256:21128f47e4e3b9d29ce5c59c0ab98341a9f8e8da8e1da9ffa6b8651d2d8f3a5c
requests==2.31.0 \
    --hash=sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003eb

# npm audit (脆弱性チェック)
npm audit
npm audit --audit-level=high
npm audit fix  # 自動修正
 
# pip-audit (Python)
pip install pip-audit
pip-audit -r requirements.txt
 
# cargo audit (Rust)
cargo install cargo-audit
cargo audit
 
# Trivy でファイルシステムスキャン
trivy fs --scanners vuln .
 
# Renovate / Dependabot で自動更新 PR

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "security:openssf-scorecard"
  ],
  "labels": ["dependencies"],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"]
  },
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true,
      "automergeType": "pr",
      "requiredStatusChecks": ["ci"]
    },
    {
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "reviewers": ["team:platform"]
    },
    {
      "matchPackagePatterns": ["^@types/"],
      "automerge": true,
      "schedule": ["before 9am on monday"]
    }
  ],
  "docker": {
    "pinDigests": true
  },
  "helm-values": {
    "fileMatch": ["values.*\\.yaml$"]
  }
}

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    reviewers:
      - "myorg/platform-team"
    labels:
      - "dependencies"
    open-pull-requests-limit: 10
    groups:
      production-dependencies:
        patterns:
          - "*"
        exclude-patterns:
          - "@types/*"
          - "eslint*"
          - "*jest*"
      dev-dependencies:
        patterns:
          - "@types/*"
          - "eslint*"
          - "*jest*"
 
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
 
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

# Kyverno ポリシー: 署名済みイメージのみ許可
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/myorg/*"
                    issuer: "https://token.actions.githubusercontent.com"
                    rekor:
                      url: https://rekor.sigstore.dev

# policy-controller のインストール
helm repo add sigstore https://sigstore.github.io/helm-charts
helm install policy-controller sigstore/policy-controller \
  -n cosign-system --create-namespace

# ClusterImagePolicy: 署名検証ポリシー
apiVersion: policy.sigstore.dev/v1alpha1
kind: ClusterImagePolicy
metadata:
  name: require-signed-images
spec:
  images:
    - glob: "ghcr.io/myorg/**"
  authorities:
    - keyless:
        identities:
          - issuer: "https://token.actions.githubusercontent.com"
            subject: "https://github.com/myorg/*/.github/workflows/*"
        ctlog:
          url: "https://rekor.sigstore.dev"
 
---
# Namespace に適用
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    policy.sigstore.dev/include: "true"

# ConstraintTemplate: 信頼済みレジストリのみ許可
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8strustedregistries
spec:
  crd:
    spec:
      names:
        kind: K8sTrustedRegistries
      validation:
        openAPIV3Schema:
          type: object
          properties:
            registries:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package trustedregistries
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not trusted(container.image)
          msg := sprintf("Image '%v' is not from a trusted registry", [container.image])
        }
        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          not trusted(container.image)
          msg := sprintf("Init container image '%v' is not from a trusted registry", [container.image])
        }
        trusted(image) {
          registry := input.parameters.registries[_]
          startswith(image, registry)
        }
 
---
# Constraint: 適用
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sTrustedRegistries
metadata:
  name: require-trusted-registry
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["production", "staging"]
  parameters:
    registries:
      - "ghcr.io/myorg/"
      - "gcr.io/myproject/"

# Kyverno ポリシー: タグではなくダイジェストでの参照を強制
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-image-digest
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-digest
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - production
      validate:
        message: "Images must be referenced by digest (@sha256:...), not by tag."
        pattern:
          spec:
            containers:
              - image: "*@sha256:*"

# ECR: イミュータブルタグの有効化
aws ecr put-image-tag-mutability \
  --repository-name myapp \
  --image-tag-mutability IMMUTABLE
 
# GHCR: タグの上書き防止 (組織設定)
# GitHub Organization Settings -> Packages -> Default repository permissions
# "Prevent forked repositories from creating packages" を有効化

# ECR: スキャン設定
aws ecr put-image-scanning-configuration \
  --repository-name myapp \
  --image-scanning-configuration scanOnPush=true
 
# GCR: Container Analysis の有効化
gcloud services enable containeranalysis.googleapis.com
gcloud services enable containerscanning.googleapis.com

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPushFromCI",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/github-actions-role"
      },
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:CompleteLayerUpload",
        "ecr:InitiateLayerUpload",
        "ecr:PutImage",
        "ecr:UploadLayerPart"
      ]
    },
    {
      "Sid": "AllowPullFromEKS",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/eks-node-role"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]
    },
    {
      "Sid": "DenyDeleteImages",
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "ecr:BatchDeleteImage",
        "ecr:DeleteRepository"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalArn": "arn:aws:iam::123456789012:role/admin-role"
        }
      }
    }
  ]
}

# NG: タグは上書き可能。改ざんリスクがある
containers:
  - name: app
    image: ghcr.io/myorg/myapp:latest
    # "latest" タグが別のイメージに差し替えられる可能性
 
# NG: セマンティックバージョンタグでも同じ問題
containers:
  - name: app
    image: ghcr.io/myorg/myapp:1.0.0
    # タグは再割り当て可能
 
# OK: ダイジェスト (SHA256) で参照
containers:
  - name: app
    image: ghcr.io/myorg/myapp@sha256:a1b2c3d4e5f6...
    # ダイジェストはイメージの内容に対する一意なハッシュ
    # 改ざんされていれば検証で失敗する

# NG: SBOM を生成して放置
trivy image --format spdx-json -o sbom.json myapp:latest
# -> ファイルが生成されるだけで誰も見ない
 
# OK: SBOM を継続的に活用するパイプライン
# 1. SBOM 生成 + イメージに添付
trivy image --format spdx-json -o sbom.json myapp:latest
cosign attach sbom --sbom sbom.json ghcr.io/myorg/myapp@sha256:xxx
 
# 2. 定期的な脆弱性再スキャン (新しい CVE の検出)
trivy sbom sbom.json  # 新しい脆弱性DBで再スキャン
 
# 3. ライセンスコンプライアンスチェック
trivy sbom --scanners license sbom.json
 
# 4. 依存関係の棚卸し (EOL パッケージの検出)
 
# 5. VEX で影響度を判断・記録

# NG: lockfile が .gitignore に含まれている
# .gitignore
package-lock.json
pnpm-lock.yaml
yarn.lock
 
# OK: lockfile は必ず Git にコミット
# lockfile により、全ての開発者と CI/CD で同じ依存関係が再現される
# lockfile なしでは、ビルドごとに異なるバージョンがインストールされるリスクがある

# NG: 本番環境でのみ署名検証
# -> ステージングで動作確認 -> 本番で署名検証に失敗 -> デプロイできない
 
# OK: ステージングから署名検証を適用
# ステージング: Audit モード (検証失敗をログに記録するが拒否しない)
# 本番: Enforce モード (検証失敗時にデプロイを拒否)