Chain-bench 是一个开源工具，用于根据新的
CIS 软件供应链基准
审计你的软件供应链栈的安全合规性。
审计重点覆盖整个 SDLC 流程，可揭示从编码到部署阶段的风险。为了在与黑客的竞赛中胜出，并保护敏感数据和客户信任，你需要确保代码符合组织的策略。
更多信息请阅读 Chain-bench 文档
Chain-bench 是一个开源工具，用于根据新的 CIS 软件供应链基准 审计你的软件供应链栈的安全合规性。 审计重点覆盖整个 SDLC 流程，可揭示从编码到部署阶段的风险。
运行 chain-bench 的主要方式是作为独立的 CLI 工具。它需要你账户的访问令牌和仓库 URL，以便访问你的 SCM。
通过你喜欢的安装方式获取 Chain-bench。详情请参阅文档中的[安装]部分。例如：
brew install chain-benchnix-env --install -A nixpkgs.chain-benchdocker run aquasec/chain-benchchain-bench scan --repository-url <REPOSITORY_URL> --access-token <TOKEN> -o <OUTPUT_PATH>
chain-bench scan --repository-url <REPOSITORY_URL> --scm-platform <SCM_PLATFORM> --access-token <TOKEN> -o <OUTPUT_PATH>
scm-platform 支持的值有 "github" 和 "gitlab"（测试版）
docker run aquasec/chain-bench scan --repository-url <REPOSITORY_URL> --access-token <TOKEN>
请参见仓库 https://github.com/aquasecurity/chain-bench-action
2022-06-13 15:22:18 INF 🚩 Fetch Starting
2022-06-13 15:22:19 INF 🏢 Fetching Organization Settings Finished
2022-06-13 15:22:29 INF 🛢️ Fetching Repository Settings Finished
2022-06-13 15:22:29 INF 🌱 Fetching Branch Protection Settings Finished
2022-06-13 15:22:29 INF 👫 Fetching Members Finished
2022-06-13 15:22:31 INF 🔧 Fetching Pipelines Finished
2022-06-13 15:22:31 INF 🏁 Fetch succeeded
ID Name Result Reason
-------- ----------------------------------------------------------------------------------------------- -------- ---------------------------------------
1.1.3 Ensure any change to code receives approval of two strongly authenticated users Passed
1.1.4 Ensure previous approvals are dismissed when updates are introduced to a code change proposal Failed
1.1.5 Ensure that there are restrictions on who can dismiss code change reviews Failed
1.1.6 Ensure code owners are set for extra sensitive code or configuration Failed
1.1.8 Ensure inactive branches are reviewed and removed periodically Failed 20 inactive branches
1.1.9 Ensure all checks have passed before the merge of new code Passed
1.1.10 Ensure open git branches are up to date before they can be merged into codebase Passed
1.1.11 Ensure all open comments are resolved before allowing to merge code changes Passed
1.1.12 Ensure verifying signed commits of new changes before merging Failed
1.1.13 Ensure linear history is required Passed
1.1.14 Ensure branch protection rules are enforced on administrators Failed
1.1.15 Ensure pushing of new code is restricted to specific individuals or teams Passed
1.1.16 Ensure force pushes code to branches is denied Failed
1.1.17 Ensure branch deletions are denied Failed
1.2.1 Ensure all public repositories contain a SECURITY.md file Failed
1.2.2 Ensure repository creation is limited to specific members Failed
1.2.3 Ensure repository deletion is limited to specific members Passed
1.2.4 Ensure issue deletion is limited to specific members Passed
1.3.1 Ensure inactive users are reviewed and removed periodically Failed 22 inactive users
1.3.3 Ensure minimum admins are set for the organization Passed
1.3.5 Ensure the organization is requiring members to use MFA Passed
1.3.7 Ensure 2 admins are set for each repository Failed
1.3.8 Ensure strict base permissions are set for repositories Passed
1.3.9 Ensure an organization's identity is confirmed with a Verified badge Failed
2.3.1 Ensure all build steps are defined as code Failed No build job was found in pipelines
2.3.5 Ensure access to the build process's triggering is minimized Passed
2.3.7 Ensure pipelines are automatically scanned for vulnerabilities Passed
2.3.8 Ensure scanners are in place to identify and prevent sensitive data in pipeline files Failed Repository is not scanned for secrets
2.4.2 Ensure all external dependencies used in the build process are locked Failed 16 task(s) are not pinned
2.4.6 Ensure pipeline steps produce an SBOM Passed
3.1.7 Ensure dependencies are pinned to a specific, verified version Failed 16 dependencies are not pinned
3.2.2 Ensure packages are automatically scanned for known vulnerabilities Passed
3.2.3 Ensure packages are automatically scanned for license implications Passed
4.2.3 Ensure user's access to the package registry utilizes MFA Passed
4.2.5 Ensure anonymous access to artifacts is revoked Passed
4.3.4 Ensure webhooks of the package registry are secured Passed
-------- ----------------------------------------------------------------------------------------------- -------- ---------------------------------------
Total Passed Rules: 19 out of 36
2022-06-13 15:22:31 INF Scan completed: 13.108s
你可以将 chain-bench 结果集成到 Gitlab 漏洞报告 中，只需在 CI 定义中添加一个新步骤：
chain-bench-scanning:
stage: test
image:
name: docker.io/aquasec/chain-bench
entrypoint: [""]
script:
- chain-bench scan --repository-url $CI_PROJECT_URL --access-token $CHAIN_BENCH_TOKEN --scm-platform gitlab -o results.json --template @/templates/gitlab_security_scanner.tpl
artifacts:
reports:
container_scanning: results.json
Maintainer，权限包括 read_api 和 read_repository，并将其作为环境变量使用（例如 $CHAIN_BENCH_TOKEN）需要提供一个访问令牌，其权限范围包括：repo（全部）、read:repo_hook、admin:org_hook、read:org
目前我们支持 Github 和 Gitlab SCM，使用 PAT 认证。
Chain-bench 尽可能精确地实现了 CIS 软件供应链基准。 当前已实现的检查项可在 AVD - Software Supply Chain CIS - 1.0 中找到，该页面基于 chain-bench 的 metadata.json 文件每晚更新。 如果 chain-bench 未能正确实现基准中描述的测试，请在此处提交问题。若要报告基准本身的问题（例如，你认为不合适的测试），请加入 CIS 社区。
请在贡献之前阅读贡献指南。 我们欢迎 PR 和问题报告。
未来我们计划发布 chain-bench 更新，通过更多检查项扩展基准覆盖范围，并支持更多平台。 Chain-bench 是 Aqua Security 的开源项目，属于 Trivy 系列。