瞭解證據聲明等級

1.建議模式：

當符合性檢查標示為「建議」時，它們的作用是警告而非阻擋。 這表示

• 即使檢查失敗，流水線仍會繼續執行
• 管道提供合規狀態的能見度，但不會強制自動失敗
• 您負責調查並解決所有標記的問題
• 所有失敗或遺漏的合規性檢查都必須在您的 CI 程序中處理和修正

此方法強調共同承擔責任的模式：管道提供法規遵循的可視性和建議，但團隊必須積極確保其 CI 流程產生所需的證據，並在生產部署之前解決任何缺口。

2.所需的模式：

證據必須存在於 success 狀態。 如果證據遺失、待定或失敗，部署會受阻。

3.如果存在模式，則必須使用：

如果證據存在，則必須處於 success 狀態。 此模式：

• 僅當證據狀態為 failure
• 如果證據是 success, pending，或 missing
• 對於執行時必須通過的可選掃描非常有用

證據彙集

證據彙集是蒐集並評估多種服務環境 (dev、stage、prod) 的合規性證據，以判斷整體應用程式層級合規性的程序。 在 CI/CD 管線執行期間，各種法規遵循工具會收集不同資產類型 (影像、提交、工件) 的證據。 證據會分別追蹤每個服務環境，系統會根據您設定檔中定義的規則彙總結果。 整體符合性狀況是透過評估所有收集到的證據是否符合設定的要求來判定。

主要優點：

• 特定環境驗證：不同的環境可能有不同的證據要求 (例如，階段可能比 prod 需要較少的檢查)
• 彈性組態：自訂每個環境需要、建議或有條件需要的證據類型
• 升級閘門：如果在之前的環境中缺少所需的證據或失敗，則阻止部署到生產環境中
• 稽核追蹤：在所有環境中維護完整的證據記錄，以便進行合規性報告

下圖說明了證據如何在環境中流通，以及彙總如何決定部署就緒程度：

設定檔區段

部署前檢查：

• 驗證 CI 管道產生的證據
• 根據這些檢查進行閘門部署
• 如果所有檢查都通過，則自動批准變更請求
• 如果檢查失敗，則阻止部署（ emergency 變更請求除外）
• 新增組態檔案作為變更請求的一部分

部署後檢查：

• 驗證 CD 管道產生的證據
• 根據這些檢查評估管道

設定檔規則結構

設定檔使用下列 JSON 結構定義驗證規則。 每種證據類型都可以根據資產類型和環境制定多種規則：

結構：

• 證據類型 ID- 例如：com.ibm.static-scan
  • rules
  • 資產類型- 例如：image, commit、artifact
  • 來源環境- 證據來源
    • name- 環境名稱 (例如：ci-pipeline, stage, prod)
    • 地區- 地理區域（可選）
  • target_environments- 驗證證據的地方
    • name- 環境名稱 (例如 stage, prod)
    • 地區- 地理區域（可選）
  • required- 證據必須存在於 success 狀態；如果遺失、待定或失敗，則會阻擋部署
    • 工具- 收集證據的工具類型 (例如 SonarQube, owasp-zap, *)
  • required_if_present- 如果證據存在，則必須處於 success 狀態；只有在 failure 狀態時才會失敗；如果 success, pending，或 missing
    • 工具- 收集證據的工具類型 (例如 SonarQube, owasp-zap, *)
  • 建議- 如果證據遺失/待定/失敗，管道會記錄警告；不會阻礙部署
    • 工具- 收集證據的工具類型 (例如 SonarQube, owasp-zap, *)

在 CI 管道中收集的證據，其來源欄位應設定為 ci-pipeline。

有關證據聲明等級 (必須、若有則必須、建議) 的詳細說明，請參閱 Config 檔案模式 章節。

使用設定檔驗證

若要在工具鏈中實作組態檔案模式，請遵循下列組態步驟：

步驟 1：啟用證據驗證

在您的 CD 和 CC 管道環境屬性中，設定下列變數，以在您的部署管道中啟用證據驗證功能：

opt-in-evidence-checks=1

步驟 2：設定驗證檔路徑

在 pipeline-config-repo 中設定您的設定檔路徑：

evidence-checks-config-path=validation.json

如果沒有定義 evidence-checks-config-path，系統會自動在 pipeline-config-repo 中搜尋名稱為 <region>.<target>.validation.json, <target>.validation.json，或 validation.json 的檔案。

步驟 3：驗證設定

一旦管道開始執行，請依照下列步驟驗證是否已啟用基於組態檔案的證據驗證：

1. 存取管道- 導覽到與您的變更相關的特定 CD 管道執行
2. 定位任務- 尋找標示為 prod-change-request 的任務，並選擇 change-request 步驟
3. 檢閱表格- 藉由搜尋這些關鍵字找出兩個關鍵表格：
   • 資產範圍表：搜尋 Current pipeline scope (第一個表)
   • 證據核對表：搜尋 PRE-DEPLOYMENT (第二個表格)

如果您可以看到這些表格，就證實已啟用基於組態檔案的證據驗證。

注意： 當 CD 和 CC 管道都啟用檢查時，利用組態檔案也會發生管道評估。

各種部署拓樸

以下範例展示證據驗證如何在不同的部署拓樸中運作。 每個拓樸顯示了在一個環境中收集的證據如何在晉升到後續環境時得到驗證。

服務環境：

• master 或 dev- 開發
• stage- 預製（最近支援）
• prod- 生產

{
  "evidence_type_id": "com.ibm.acceptance_tests",
  "rules": [
    {
      "asset_type": "image",
      "source_environments": [
        {
          "name": "ci-pipeline"
        }
      ],
      "target_environments": [
        {
          "name": "prod"
        }
      ],
      "required": [],
      "required_if_present": [
        {
          "name": "tool",
          "values": [
            "*"
          ],
          "description": "Acceptance tests must pass if they are run"
        }
      ],
      "recommended": []
    }
  ]
}

{
  "evidence_type_id": "com.ibm.acceptance_tests",
  "rules": [
    {
      "asset_type": "image",
      "source_environments": [
        {
          "name": "ci-pipeline"
        },
        {
          "name": "stage"
        }
      ],
      "target_environments": [
        {
          "name": "stage"
        },
        {
          "name": "prod"
        }
      ],
      "required": [],
      "required_if_present": [
        {
          "name": "tool",
          "values": [
            "*"
          ],
          "description": "Acceptance tests must pass if they are run"
        }
      ],
      "recommended": []
    }
  ]
}

{
  "evidence_type_id": "com.ibm.acceptance_tests",
  "rules": [
    {
      "asset_type": "image",
      "source_environments": [
        {
          "name": "ci-pipeline"
        },
        {
          "name": "stage",
          "region": "us-south"
        }
      ],
      "target_environments": [
        {
          "name": "stage",
          "region": "us-south"
        },
        {
          "name": "stage",
          "region": "us-east"
        },
        {
          "name": "prod",
          "region": "us-south"
        }
      ],
      "required": [],
      "required_if_present": [
        {
          "name": "tool",
          "values": [
            "*"
          ],
          "description": "Acceptance tests must pass if they are run"
        }
      ],
      "recommended": []
    }
  ]
}

DevSecOps 階段的預設工具值

不同的資產類型（例如容器影像、原始碼提交或部署工件）需要不同類型的證據。 配置檔案可讓您指定每種資產類型必須收集哪些證據類型，系統會確認相應的工具已收集適當的證據。

| com.ibm.cloud.slsa | tekton-chains | 手工藝品（舵、圖像或圖表） | | 藝術品（舵、圖像或圖表） | 藝術品（舵、圖像或圖表）

我的部署受阻 - 我要如何找出原因？

如果您的部署受阻，請按照以下步驟找出問題：

1. 存取管道- 導覽到與您的變更相關的特定 CD 管道執行
2. 定位任務- 尋找標示為 prod-change-request 的任務，並選擇 change-request 步驟
3. 檢閱表格- 藉由搜尋這些關鍵字找出兩個關鍵表格：
   • 資產範圍表：搜尋 Current pipeline scope (第一個表)
   • 證據核對表：搜尋 PRE-DEPLOYMENT (第二個表格)

證據檢查表顯示哪些證據項目是 missing 或 failed，導致您的部署受阻。

瞭解證據核對表

證據核對表顯示每項資產的證據驗證狀態。 瞭解其結構有助於您排除合規問題。

資產表結構：

• ID 欄：識別每項資產的主索引鍵
• Full_id：完整的資產 ID。
• 類型：資產的類型
• URI 欄：正在驗證的實際資產 (影像、人工制品等)
• 關係：資產 ID 是證據檢查表中的外鍵 (AssetId)

證據檢查表結構：

• AssetId 列：識別每項資產的外鍵
• EvidenceTypeId：指定需要哪些符合性證據 (例如：弱點掃描、單元測試、同儕審查)
• 證據來源：指出證據的來源 (通常為 ci-pipeline)
• 狀態：顯示每項資產的證據是否存在、遺失或失效

證據摘要表結構：

此表顯示所有資產的合規性證據摘要，並顯示有多少證據項目遺失、成功、失敗或待定。

如何修復遺失或失敗的證據？

從「證據檢查表」中找出遺失或失敗的證據後，請使用此決策樹來解決問題。 請注意特定的證據類型（如 com.ibm.static_scan ）和資產類型（如 image, commit ）。

問題「我是否已將 CI 管道設定為收集[資產類] [型的證據類型]？」

如果 NO（您沒有收集）：

• 請問"對我的服務而言，這是有效的合規要求嗎？
  • 是的，它是有效的：在您的 CI 管道中執行證據收集
  • 新增必要的掃描工具或指令碼
  • 設定適當的證據報告機制
  • 確保證據與正確的資產相關聯
  • 請參閱《 資產證據收集指南 》 以瞭解實施細節
  • 不，不適用：記錄理由並升級
  • 聯絡您的安全聯絡人
  • 解釋為何此選項不適用於您的服務
  • 提供明確的理由
  • 核准後從您的組態檔案中移除檢查

如果「是」（您之前已收集此證據）：

• 調查為何在證據檢查表中顯示為遺失
• 需要檢查的潛在問題：
  • 證據是否在您的 CI 管道中正確產生？
  • 是否已報告到正確的位置？
  • 資產 ID 是否與證據正確連結？
  • CI 和 CD 管道之間是否存在時序或同步問題？
  • 證據格式是否符合驗證要求？
  • 檢查管道日誌，找出與證據收集或報告相關的錯誤訊息

配置檔案範例

{
  "version": "2.0",
  "pre-deployment": [
    {
      "evidence_type_id": "com.ibm.prod_change_request",
      "rules": [
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "stage"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Change request must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.acceptance_tests",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            },
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Acceptance tests must pass if they are run"
            }
          ],
          "recommended": []
        },
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Acceptance tests must pass if they are run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.branch_protection",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Branch protection must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.cloud.slsa",
      "rules": [
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "SLSA attestation must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.dynamic_scan",
      "rules": [
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "owasp-zap"
              ],
              "description": "Dynamic scan must pass if OWASP ZAP is run"
            }
          ],
          "recommended": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Other dynamic scan tools are recommended"
            }
          ]
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.cloud.verify_signature",
      "rules": [
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Signature verification must pass if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.cloud.image_vulnerability_scan",
      "rules": [
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Image vulnerability scan must pass if run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.peer_review",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Peer review must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.unit_tests",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Unit tests must pass if they are run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.static_scan",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Static scan must pass if run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.detect_secrets",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Detect secrets scan must pass if run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.code_vulnerability_scan",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Code vulnerability scan must pass if run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.code_cis_check",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "CIS check must pass if run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.code_bom_check",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "BOM check must pass if run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.network_compliance",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Network compliance check must pass if run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.pipeline_run_data",
      "rules": [
        {
          "asset_type": "generic",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Pipeline run data must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.pipeline_logs",
      "rules": [
        {
          "asset_type": "generic",
          "source_environments": [
            {
              "name": "ci-pipeline"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Pipeline logs must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    }
  ],
  "post-deployment": [
    {
      "evidence_type_id": "com.ibm.prod_change_request",
      "rules": [
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "stage"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Change request must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.acceptance_tests",
      "rules": [
        {
          "asset_type": "commit",
          "source_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Acceptance tests must pass if they are run"
            }
          ],
          "recommended": []
        },
        {
          "asset_type": "image",
          "source_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Acceptance tests must pass if they are run"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.pipeline_run_data",
      "rules": [
        {
          "asset_type": "generic",
          "source_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Pipeline run data must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    },
    {
      "evidence_type_id": "com.ibm.pipeline_logs",
      "rules": [
        {
          "asset_type": "generic",
          "source_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "target_environments": [
            {
              "name": "stage"
            },
            {
              "name": "prod"
            }
          ],
          "required": [],
          "required_if_present": [
            {
              "name": "tool",
              "values": [
                "*"
              ],
              "description": "Pipeline logs must be successful if present"
            }
          ],
          "recommended": []
        }
      ]
    }
  ]
}