コンテナイメージセキュリティとソフトウェアサプライチェーン保護：Trivy、Cosign、SBOM、Sigstore実践ガイド

# Trivyインストール（macOS）
brew install trivy

# Trivyインストール（Linux）
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# バージョン確認
trivy version

# 基本的なイメージスキャン - すべての重大度レベルを表示
trivy image nginx:1.25

# HIGHとCRITICALのみフィルタリング、修正可能な脆弱性のみ表示
trivy image --severity HIGH,CRITICAL --ignore-unfixed nginx:1.25

# JSON形式で結果を出力（CI/CDパイプライン連携用）
trivy image --format json --output results.json nginx:1.25

# 特定のCVEをスキップするための.trivyignoreファイルを使用
trivy image --ignorefile .trivyignore myapp:latest

# SBOMベースのスキャン（既存のSBOMを入力として使用）
trivy sbom ./sbom.cyclonedx.json

# .trivyignore - 承認された例外リスト
# 有効期限と理由を必ず記録すること

# CVE-2024-1234: 該当機能未使用、2026-04-01まで猶予
CVE-2024-1234

# CVE-2024-5678: アップストリームパッチ待ち
CVE-2024-5678

# Cosignインストール
brew install cosign

# 1. キーペア生成（従来の方式）
cosign generate-key-pair

# 2. イメージ署名（キーベース）
cosign sign --key cosign.key myregistry.io/myapp:v1.0.0

# 3. キーレス署名（Sigstore Fulcio使用 - 推奨）
# OIDC認証後に自動的に短期証明書を発行
cosign sign myregistry.io/myapp:v1.0.0

# 4. 署名検証
cosign verify --key cosign.pub myregistry.io/myapp:v1.0.0

# 5. キーレス署名検証（証明書発行者とIDを指定）
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/myorg/myrepo" \
  myregistry.io/myapp:v1.0.0

# ビルドメタデータを署名に含める
cosign sign \
  -a "git.sha=$(git rev-parse HEAD)" \
  -a "build.timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  -a "build.pipeline=github-actions" \
  myregistry.io/myapp:v1.0.0

# 署名とアノテーションの検証
cosign verify --key cosign.pub myregistry.io/myapp:v1.0.0 | jq .

# Syftインストール
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# CycloneDXフォーマットでSBOM生成（コンテナイメージ）
syft myregistry.io/myapp:v1.0.0 -o cyclonedx-json=sbom-cyclonedx.json

# SPDXフォーマットでSBOM生成
syft myregistry.io/myapp:v1.0.0 -o spdx-json=sbom-spdx.json

# ローカルディレクトリからSBOM生成
syft dir:./my-project -o cyclonedx-json=sbom.json

# TrivyでもSBOM生成が可能
trivy image --format cyclonedx --output sbom-trivy.json myregistry.io/myapp:v1.0.0

# SBOMをOCIレジストリに添付（Cosign活用）
cosign attach sbom --sbom sbom-cyclonedx.json myregistry.io/myapp:v1.0.0

# ランタイムSBOMとビルド時点SBOMの比較
# 1. ビルド時点SBOM（すでに生成済み）
# sbom-build.json

# 2. 実行中のコンテナから現在の状態を抽出
docker exec running-container syft / -o cyclonedx-json > sbom-runtime.json

# 3. 差分を比較
diff <(jq -r '.components[].name' sbom-build.json | sort) \
     <(jq -r '.components[].name' sbom-runtime.json | sort)

name: Container Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: my-org/my-app

jobs:
  build-scan-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write # キーレス署名に必要

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ghcr.io/my-org/my-app:${{ github.sha }}

      # Step 1: 脆弱性スキャン
      - name: Trivy Vulnerability Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/my-org/my-app:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: HIGH,CRITICAL
          exit-code: '1'

      - name: Upload Trivy Results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

      # Step 2: SBOM生成
      - name: Generate SBOM with Syft
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/my-org/my-app:${{ github.sha }}
          format: cyclonedx-json
          output-file: sbom.cyclonedx.json

      # Step 3: Cosignでイメージ署名（キーレス）
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign Container Image
        run: |
          cosign sign --yes \
            -a "git.sha=${{ github.sha }}" \
            -a "build.pipeline=github-actions" \
            ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}

      # Step 4: SBOM添付
      - name: Attach SBOM to Image
        run: |
          cosign attach sbom \
            --sbom sbom.cyclonedx.json \
            ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}

      # Step 5: SBOMアテステーション署名
      - name: Sign SBOM Attestation
        run: |
          cosign attest --yes \
            --predicate sbom.cyclonedx.json \
            --type cyclonedx \
            ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - 'ghcr.io/my-org/*'
          attestors:
            - entries:
                - keyless:
                    issuer: 'https://token.actions.githubusercontent.com'
                    subject: 'https://github.com/my-org/my-repo/.github/workflows/*'
                    rekor:
                      url: 'https://rekor.sigstore.dev'
          attestations:
            - type: 'https://cyclonedx.org/bom'
              conditions:
                - all:
                    - key: 'components'
                      operator: NotEquals
                      value: ''

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequireimagedigest
spec:
  crd:
    spec:
      names:
        kind: K8sRequireImageDigest
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequireimagedigest

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not contains(container.image, "@sha256:")
          msg := sprintf(
            "Container '%v' must use image digest (sha256) instead of tag: %v",
            [container.name, container.image]
          )
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          not contains(container.image, "@sha256:")
          msg := sprintf(
            "Init container '%v' must use image digest (sha256) instead of tag: %v",
            [container.name, container.image]
          )
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireImageDigest
metadata:
  name: require-image-digest
spec:
  match:
    kinds:
      - apiGroups: ['']
        kinds: ['Pod']
    namespaces:
      - production

# 緊急隔離：NetworkPolicyを適用
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: emergency-isolate
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: compromised-app
  policyTypes:
    - Ingress
    - Egress
EOF

# 緊急スキャン
trivy image --severity CRITICAL compromised-image:tag

# SBOMから影響を受けるイメージを検索
for sbom in sbom-*.json; do
  if jq -e '.components[] | select(.name == "libexpat")' "$sbom" > /dev/null 2>&1; then
    echo "AFFECTED: $sbom"
  fi
done

# パッチ済みベースイメージで再ビルド
docker build --no-cache --build-arg BASE_IMAGE=nginx:1.25.4-alpine -t myapp:patched .

# ローリングアップデート
kubectl set image deployment/myapp myapp=myregistry.io/myapp:patched
kubectl rollout status deployment/myapp

# SLSA Provenance生成ワークフロー
name: SLSA Build Provenance

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      - name: Build Image
        id: build
        run: |
          docker build -t ghcr.io/my-org/my-app:${{ github.ref_name }} .
          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/my-org/my-app:${{ github.ref_name }} | cut -d@ -f2)
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

  provenance:
    needs: build
    permissions:
      actions: read
      id-token: write
      packages: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ghcr.io/my-org/my-app
      digest: ${{ needs.build.outputs.digest }}
    secrets:
      registry-username: ${{ github.actor }}
      registry-password: ${{ secrets.GITHUB_TOKEN }}