컨테이너 이미지 보안과 소프트웨어 공급망 보호: Trivy, Cosign, SBOM, Sigstore 실전 가이드

# Trivy 설치 (macOS)
brew install trivy

# Trivy 설치 (Linux)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# 버전 확인
trivy version

# 기본 이미지 스캔 - 모든 심각도의 취약점 표시
trivy image nginx:1.25

# HIGH, CRITICAL만 필터링하고 수정 가능한 취약점만 표시
trivy image --severity HIGH,CRITICAL --ignore-unfixed nginx:1.25

# JSON 형식으로 결과 출력 (CI/CD 파이프라인 연동용)
trivy image --format json --output results.json nginx:1.25

# 특정 CVE를 무시하도록 설정 (.trivyignore 파일 활용)
trivy image --ignorefile .trivyignore myapp:latest

# SBOM 기반 스캔 (이미 생성된 SBOM을 입력으로 사용)
trivy sbom ./sbom.cyclonedx.json

# .trivyignore - 허용된 예외 목록
# 만료일과 사유를 반드시 기록할 것

# CVE-2024-1234: 해당 기능 미사용, 2026-04-01까지 유예
CVE-2024-1234

# CVE-2024-5678: 업스트림 패치 대기 중
CVE-2024-5678

# Cosign 설치
brew install cosign

# 1. 키 페어 생성 (전통적 방식)
cosign generate-key-pair

# 2. 이미지 서명 (키 기반)
cosign sign --key cosign.key myregistry.io/myapp:v1.0.0

# 3. 키리스 서명 (Sigstore Fulcio 사용 - 권장)
# OIDC 인증 후 자동으로 단기 인증서 발급
cosign sign myregistry.io/myapp:v1.0.0

# 4. 서명 검증
cosign verify --key cosign.pub myregistry.io/myapp:v1.0.0

# 5. 키리스 서명 검증 (인증서 발급자와 ID 지정)
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/myorg/myrepo" \
  myregistry.io/myapp:v1.0.0

# 빌드 메타데이터를 서명에 포함
cosign sign \
  -a "git.sha=$(git rev-parse HEAD)" \
  -a "build.timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  -a "build.pipeline=github-actions" \
  myregistry.io/myapp:v1.0.0

# 서명과 어노테이션 함께 검증
cosign verify --key cosign.pub myregistry.io/myapp:v1.0.0 | jq .

# Syft 설치
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# CycloneDX 포맷으로 SBOM 생성 (컨테이너 이미지)
syft myregistry.io/myapp:v1.0.0 -o cyclonedx-json=sbom-cyclonedx.json

# SPDX 포맷으로 SBOM 생성
syft myregistry.io/myapp:v1.0.0 -o spdx-json=sbom-spdx.json

# 로컬 디렉토리 기반 SBOM 생성
syft dir:./my-project -o cyclonedx-json=sbom.json

# Trivy로도 SBOM 생성 가능
trivy image --format cyclonedx --output sbom-trivy.json myregistry.io/myapp:v1.0.0

# SBOM을 OCI 레지스트리에 첨부 (Cosign 활용)
cosign attach sbom --sbom sbom-cyclonedx.json myregistry.io/myapp:v1.0.0

# 런타임 SBOM과 빌드 시점 SBOM 비교
# 1. 빌드 시점 SBOM (이미 생성됨)
# sbom-build.json

# 2. 런타임 컨테이너에서 현재 상태 추출
docker exec running-container syft / -o cyclonedx-json > sbom-runtime.json

# 3. 차이점 비교 (cyclonedx-diff 또는 직접 비교)
diff <(jq -r '.components[].name' sbom-build.json | sort) \
     <(jq -r '.components[].name' sbom-runtime.json | sort)

name: Container Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: my-org/my-app

jobs:
  build-scan-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write # Keyless 서명에 필요

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ghcr.io/my-org/my-app:${{ github.sha }}

      # Step 1: 취약점 스캔
      - name: Trivy Vulnerability Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/my-org/my-app:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: HIGH,CRITICAL
          exit-code: '1'

      - name: Upload Trivy Results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

      # Step 2: SBOM 생성
      - name: Generate SBOM with Syft
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/my-org/my-app:${{ github.sha }}
          format: cyclonedx-json
          output-file: sbom.cyclonedx.json

      # Step 3: Cosign으로 이미지 서명 (Keyless)
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign Container Image
        run: |
          cosign sign --yes \
            -a "git.sha=${{ github.sha }}" \
            -a "build.pipeline=github-actions" \
            ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}

      # Step 4: SBOM 첨부
      - name: Attach SBOM to Image
        run: |
          cosign attach sbom \
            --sbom sbom.cyclonedx.json \
            ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}

      # Step 5: SBOM에도 서명
      - name: Sign SBOM Attestation
        run: |
          cosign attest --yes \
            --predicate sbom.cyclonedx.json \
            --type cyclonedx \
            ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - 'ghcr.io/my-org/*'
          attestors:
            - entries:
                - keyless:
                    issuer: 'https://token.actions.githubusercontent.com'
                    subject: 'https://github.com/my-org/my-repo/.github/workflows/*'
                    rekor:
                      url: 'https://rekor.sigstore.dev'
          attestations:
            - type: 'https://cyclonedx.org/bom'
              conditions:
                - all:
                    - key: 'components'
                      operator: NotEquals
                      value: ''

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequireimagedigest
spec:
  crd:
    spec:
      names:
        kind: K8sRequireImageDigest
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequireimagedigest

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not contains(container.image, "@sha256:")
          msg := sprintf(
            "Container '%v' must use image digest (sha256) instead of tag: %v",
            [container.name, container.image]
          )
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          not contains(container.image, "@sha256:")
          msg := sprintf(
            "Init container '%v' must use image digest (sha256) instead of tag: %v",
            [container.name, container.image]
          )
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireImageDigest
metadata:
  name: require-image-digest
spec:
  match:
    kinds:
      - apiGroups: ['']
        kinds: ['Pod']
    namespaces:
      - production

# 긴급 격리: NetworkPolicy 적용
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: emergency-isolate
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: compromised-app
  policyTypes:
    - Ingress
    - Egress
EOF

# 긴급 스캔
trivy image --severity CRITICAL compromised-image:tag

# SBOM에서 영향받는 이미지 검색
for sbom in sbom-*.json; do
  if jq -e '.components[] | select(.name == "libexpat")' "$sbom" > /dev/null 2>&1; then
    echo "AFFECTED: $sbom"
  fi
done

# 패치된 베이스 이미지로 재빌드
docker build --no-cache --build-arg BASE_IMAGE=nginx:1.25.4-alpine -t myapp:patched .

# 롤링 업데이트
kubectl set image deployment/myapp myapp=myregistry.io/myapp:patched
kubectl rollout status deployment/myapp

# SLSA Provenance 생성 워크플로우 (별도 재사용 가능 워크플로우 호출)
name: SLSA Build Provenance

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      - name: Build Image
        id: build
        run: |
          docker build -t ghcr.io/my-org/my-app:${{ github.ref_name }} .
          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/my-org/my-app:${{ github.ref_name }} | cut -d@ -f2)
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

  provenance:
    needs: build
    permissions:
      actions: read
      id-token: write
      packages: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ghcr.io/my-org/my-app
      digest: ${{ needs.build.outputs.digest }}
    secrets:
      registry-username: ${{ github.actor }}
      registry-password: ${{ secrets.GITHUB_TOKEN }}