revise April 2023 dependency security articles

2026-07-31 14:29:45 +03:00
parent 31ed7053e7
commit b78758dd3d
7 changed files with 668 additions and 1 deletions
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 760" role="img" aria-labelledby="title description">
+  <title id="title">Разбор advisory зависимости до решения об обновлении</title>
+  <desc id="description">Внешний advisory сопоставляется с lockfile и SBOM, затем формулируется гипотеза достижимости от точки входа. Только после этого возможен project review; схема не делает вывода об уязвимости.</desc>
+  <rect width="720" height="760" fill="#f7fafc"/>
+  <rect x="28" y="26" width="664" height="88" rx="18" fill="#123047"/>
+  <text x="56" y="64" fill="#ffffff" font-family="Arial, sans-serif" font-size="28" font-weight="700">Advisory — вход в triage, не вердикт</text>
+  <text x="56" y="92" fill="#c9e7f2" font-family="Arial, sans-serif" font-size="20">Все значения на схеме — вопросы для project review</text>
+
+  <rect x="56" y="152" width="608" height="92" rx="14" fill="#fff4d6" stroke="#c78314" stroke-width="2"/>
+  <text x="82" y="187" fill="#633d00" font-family="Arial, sans-serif" font-size="24" font-weight="700">1. External advisory</text>
+  <text x="82" y="218" fill="#633d00" font-family="Arial, sans-serif" font-size="20">package + version + source URL</text>
+  <text x="494" y="188" fill="#9b5d00" font-family="Arial, sans-serif" font-size="18" font-weight="700">SYNTHETIC</text>
+
+  <path d="M360 244 V278" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 267 L360 280 L371 267" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="306" width="282" height="124" rx="14" fill="#e5f3ff" stroke="#2774a5" stroke-width="2"/>
+  <text x="80" y="341" fill="#164766" font-family="Arial, sans-serif" font-size="23" font-weight="700">2. Lockfile</text>
+  <text x="80" y="372" fill="#164766" font-family="Arial, sans-serif" font-size="19">Есть exact package@version?</text>
+  <text x="80" y="401" fill="#164766" font-family="Arial, sans-serif" font-size="19">Это resolved tree, не runtime.</text>
+
+  <rect x="382" y="306" width="282" height="124" rx="14" fill="#e9f8ee" stroke="#2d8a54" stroke-width="2"/>
+  <text x="406" y="341" fill="#155437" font-family="Arial, sans-serif" font-size="23" font-weight="700">3. SBOM</text>
+  <text x="406" y="372" fill="#155437" font-family="Arial, sans-serif" font-size="19">Есть component record?</text>
+  <text x="406" y="401" fill="#155437" font-family="Arial, sans-serif" font-size="19">Нужна связь с build artifact.</text>
+
+  <path d="M197 430 V465 H360 V430" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M523 430 V465 H360" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 454 L360 467 L371 454" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="495" width="608" height="102" rx="14" fill="#f0ecff" stroke="#7554b8" stroke-width="2"/>
+  <text x="82" y="532" fill="#41227d" font-family="Arial, sans-serif" font-size="23" font-weight="700">4. Гипотеза достижимости</text>
+  <text x="82" y="562" fill="#41227d" font-family="Arial, sans-serif" font-size="19">entry point → import path → named scenario</text>
+  <text x="82" y="586" fill="#41227d" font-family="Arial, sans-serif" font-size="19">Не доказывает вызов уязвимой ветки.</text>
+
+  <path d="M360 597 V630" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 619 L360 632 L371 619" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="654" width="608" height="66" rx="14" fill="#123047"/>
+  <text x="82" y="695" fill="#ffffff" font-family="Arial, sans-serif" font-size="24" font-weight="700">Project review: evidence, owner, next check</text>
+  <text x="508" y="695" fill="#9fe2c2" font-family="Arial, sans-serif" font-size="18">не «safe»</text>
+</svg>
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 790" role="img" aria-labelledby="title description">
+  <title id="title">Границы manifest, lockfile, SBOM и runtime evidence</title>
+  <desc id="description">Вертикальная схема различает намерение в manifest, разрешённое дерево в lockfile, инвентарь привязанного артефакта в SBOM и наблюдённое выполнение в runtime. Между слоями показаны обязательные проверки, а не автоматические гарантии.</desc>
+  <rect width="720" height="790" fill="#f8fafc"/>
+  <rect x="28" y="26" width="664" height="86" rx="18" fill="#123047"/>
+  <text x="56" y="64" fill="#ffffff" font-family="Arial, sans-serif" font-size="28" font-weight="700">Один package, четыре вопроса</text>
+  <text x="56" y="92" fill="#c9e7f2" font-family="Arial, sans-serif" font-size="20">Списки похожи, но владеют разными фактами</text>
+
+  <rect x="56" y="148" width="608" height="100" rx="14" fill="#fff4d6" stroke="#c78314" stroke-width="2"/>
+  <text x="82" y="184" fill="#633d00" font-family="Arial, sans-serif" font-size="24" font-weight="700">Manifest</text>
+  <text x="82" y="214" fill="#633d00" font-family="Arial, sans-serif" font-size="19">Что проект просит: direct dependency и range</text>
+  <text x="552" y="214" fill="#9b5d00" font-family="Arial, sans-serif" font-size="18">intent</text>
+
+  <path d="M360 248 V282" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 271 L360 284 L371 271" fill="none" stroke="#446276" stroke-width="4"/>
+  <text x="390" y="272" fill="#446276" font-family="Arial, sans-serif" font-size="17">resolver + flags</text>
+
+  <rect x="56" y="306" width="608" height="106" rx="14" fill="#e5f3ff" stroke="#2774a5" stroke-width="2"/>
+  <text x="82" y="342" fill="#164766" font-family="Arial, sans-serif" font-size="24" font-weight="700">Lockfile</text>
+  <text x="82" y="372" fill="#164766" font-family="Arial, sans-serif" font-size="19">Какое resolved tree получил installer</text>
+  <text x="82" y="397" fill="#164766" font-family="Arial, sans-serif" font-size="19">Проверка: diff и reproducible install</text>
+
+  <path d="M360 412 V446" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 435 L360 448 L371 435" fill="none" stroke="#446276" stroke-width="4"/>
+  <text x="390" y="436" fill="#446276" font-family="Arial, sans-serif" font-size="17">build identity</text>
+
+  <rect x="56" y="470" width="608" height="106" rx="14" fill="#e9f8ee" stroke="#2d8a54" stroke-width="2"/>
+  <text x="82" y="506" fill="#155437" font-family="Arial, sans-serif" font-size="24" font-weight="700">SBOM</text>
+  <text x="82" y="536" fill="#155437" font-family="Arial, sans-serif" font-size="19">Какие components записаны для named artifact</text>
+  <text x="82" y="561" fill="#155437" font-family="Arial, sans-serif" font-size="19">Проверка: provenance, format, source revision</text>
+
+  <path d="M360 576 V610" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 599 L360 612 L371 599" fill="none" stroke="#446276" stroke-width="4"/>
+  <text x="390" y="600" fill="#446276" font-family="Arial, sans-serif" font-size="17">named environment</text>
+
+  <rect x="56" y="634" width="608" height="106" rx="14" fill="#f0ecff" stroke="#7554b8" stroke-width="2"/>
+  <text x="82" y="670" fill="#41227d" font-family="Arial, sans-serif" font-size="24" font-weight="700">Runtime evidence</text>
+  <text x="82" y="700" fill="#41227d" font-family="Arial, sans-serif" font-size="19">Что наблюдалось в конкретном scenario</text>
+  <text x="82" y="725" fill="#41227d" font-family="Arial, sans-serif" font-size="19">Не доказывает все paths и configurations</text>
+
+  <text x="360" y="775" text-anchor="middle" fill="#526475" font-family="Arial, sans-serif" font-size="18" font-weight="700">Стрелка означает «нужна проверка», а не «гарантировано»</text>
+</svg>
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 800" role="img" aria-labelledby="title description">
+  <title id="title">Порядок проверки безопасного обновления зависимости</title>
+  <desc id="description">Схема показывает gates обновления: определить scope и baseline, проверить lockfile diff, провести чистую установку, tests и runtime smoke в именованном окружении. Только затем принимается release decision; rollback является отдельным планом.</desc>
+  <rect width="720" height="800" fill="#f8fafc"/>
+  <rect x="28" y="26" width="664" height="86" rx="18" fill="#123047"/>
+  <text x="56" y="64" fill="#ffffff" font-family="Arial, sans-serif" font-size="28" font-weight="700">Безопасное обновление — цепочка evidence</text>
+  <text x="56" y="92" fill="#c9e7f2" font-family="Arial, sans-serif" font-size="20">Названный gate ещё не равен выполненной проверке</text>
+
+  <rect x="56" y="146" width="608" height="80" rx="14" fill="#fff4d6" stroke="#c78314" stroke-width="2"/>
+  <text x="82" y="179" fill="#633d00" font-family="Arial, sans-serif" font-size="23" font-weight="700">1. Scope + baseline</text>
+  <text x="82" y="207" fill="#633d00" font-family="Arial, sans-serif" font-size="19">advisory context · package · from/to version · owner</text>
+
+  <path d="M360 226 V250" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 239 L360 252 L371 239" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="268" width="608" height="80" rx="14" fill="#e5f3ff" stroke="#2774a5" stroke-width="2"/>
+  <text x="82" y="301" fill="#164766" font-family="Arial, sans-serif" font-size="23" font-weight="700">2. Lockfile diff</text>
+  <text x="82" y="329" fill="#164766" font-family="Arial, sans-serif" font-size="19">added / removed / changed records и resolver effects</text>
+
+  <path d="M360 348 V372" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 361 L360 374 L371 361" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="390" width="608" height="80" rx="14" fill="#e9f8ee" stroke="#2d8a54" stroke-width="2"/>
+  <text x="82" y="423" fill="#155437" font-family="Arial, sans-serif" font-size="23" font-weight="700">3. Clean install + project tests</text>
+  <text x="82" y="451" fill="#155437" font-family="Arial, sans-serif" font-size="19">same installer rules · named application contracts</text>
+
+  <path d="M360 470 V494" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 483 L360 496 L371 483" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="512" width="608" height="80" rx="14" fill="#f0ecff" stroke="#7554b8" stroke-width="2"/>
+  <text x="82" y="545" fill="#41227d" font-family="Arial, sans-serif" font-size="23" font-weight="700">4. Runtime smoke</text>
+  <text x="82" y="573" fill="#41227d" font-family="Arial, sans-serif" font-size="19">declared environment · startup · controlled scenario</text>
+
+  <path d="M360 592 V616" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 605 L360 618 L371 605" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="636" width="608" height="70" rx="14" fill="#123047"/>
+  <text x="82" y="679" fill="#ffffff" font-family="Arial, sans-serif" font-size="24" font-weight="700">Release decision — только с реальными artifacts</text>
+
+  <path d="M620 706 V752 H204" fill="none" stroke="#c45353" stroke-width="4" stroke-dasharray="9 8"/>
+  <path d="M215 741 L202 752 L215 763" fill="none" stroke="#c45353" stroke-width="4"/>
+  <text x="402" y="779" text-anchor="middle" fill="#9d3838" font-family="Arial, sans-serif" font-size="18" font-weight="700">Rollback plan: вернуть baseline, не стереть evidence</text>
+</svg>