BoF: Grafeas Using Artifact Metadata to Track and Govern Your Software Supply Chain

Transcription

1 BoF: Grafeas Using Artifact Metadata to Track and Govern Your Software Supply Chain Wendy Dembowski, Staff Software Engineer, Google Stephen Elliott, Product Manager, Google

2 Why are these questions so hard? Is container image X deployed right now? Did all deployed components pass required QA tests? Does vulnerability Y affect production?

3 Trends and needs of today s SDLC Computing trends Growing, fragmented toolsets Open-source software adoption Decentralization Continuous delivery Microservice architectures Metadata needs Central source of truth Universal coverage Hybrid cloud-friendly Flexible Pluggable SDLC: software development lifecycle

4 What is Grafeas? Good governance requires good data Grafeas is an open source initiative to define a uniform way to talk about artifact metadata in the modern software supply chain Specifically, it s an open API spec for storing metadata about many different artifact types (containers, VMs, software packages) and metadata kinds (vulnerabilities, build info, signatures)

5 Goals Provide a common language to store, retrieve, and query metadata on software artifacts Support metadata schemas for the most common metadata use cases Promote broad adoption so users benefit from metadata composability and portability

6 Technical overview tl;dr Grafeas is a structured metadata API for annotating cloud components Notes Created by metadata provider (in provider s project) Contains context-insensitive metadata relevant to linked occurrences Occurrences Created by metadata provider (in customer s project) Links to a provider s note Binds a note to an occurrence in a customer s resource (e.g., image)

7 Currently supported artifacts & metadata Component Type Debian Docker Generic file Maven Identifier (soon to be replaced by deb://dist(optional):arch:name:version file://sha256::name gav://group:artifact:version Metadata Kind Note Summary Occurrence Summary Package Vulnerability Build Details Image Basis CVE description and details including severity, versions Builder version and signature Base Image for a container Affected packages/versions in a specific resource Details of this specific build incl. inputs/outputs An image that uses the base image, and layers on top of base image NPM NuGet npm://package:version nuget://module:version Package Manager Package Descriptions Filesystem locations where package is installed in a specific resource Python RPM pip://package:version rpm://dist(optional):arch:name:version Deployment History Attestation A resource that can be deployed Anchor for attestations for this authority Details of each deployment of the resource An attestation on a specific component

8 Example of future Grafeas story 1. Nikhil checks in new code for component X 2. Is it safe to build component X? 3. 3rd party component scan 4. Nikhil runs component X through required tests 5. Does component X meet my security policy? Code Build Test Deploy Operate Scanner Kubernetes Engine A. Provenance recorded to Grafeas B. Yes, provenance verified C. Scan results recorded D. Test/QA sign-offs recorded DeployOperate App Engine Grafeas E. Yes, X is vulnerability-free and has QA sign-off On-premises cluster... Legend Primary development pipeline Artifact metadata flow G. CIO views compliance summary of all deployed components F. Deployment of X recorded

9 Demo Google Container Analysis Grafeas API K8s Cluster Webhook Admission Review Create Pod Kube System

10 Next Steps Try the demo for yourself Visit our Github site and get involved github.com/grafeas grafeas.io Trial the Google-hosted alpha cloud.google.com/container-registry/docs/vulnerability-scanning

11 Req ts of highly regulated industries Graeme Hay Managing Director, Enterprise Infrastructure Morgan Stanley

12 Resources Events: - KubeCon Fri morning (12/8): Grafeas meet-up at KubeCon. Submit topics for discussion at - Tue 12/12: Google/Black Duck webinar on Grafeas ( Lists: - User discussion: grafeas-users@googlegroups.com - Dev discussion: grafeas-dev@googlegroups.com Blogs: - Launch announcement, incl. links to collaborator blogs ( - Kubernetes blog (

13 Discussion Questions or topics you d like to discuss?

14 Appendices

15 15 Project-scoped Metadata Provider A Metadata Provider B Metadata Provider C Note name kind shortmsg longmsg remediation relatedurl Note name kind shortmsg longmsg remediation relatedurl Note name kind shortmsg longmsg remediation relatedurl Finding resource _url result Finding resource _url result User Projects Occurrence resource_url note_name... Occurrence resource_url note_name...

16 Example note 16

17 Example occurrence 17