revise April 2023 dependency security articles

2026-07-31 14:29:45 +03:00
parent 31ed7053e7
commit b78758dd3d
7 changed files with 668 additions and 1 deletions
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 760" role="img" aria-labelledby="title description">
+  <title id="title">Разбор advisory зависимости до решения об обновлении</title>
+  <desc id="description">Внешний advisory сопоставляется с lockfile и SBOM, затем формулируется гипотеза достижимости от точки входа. Только после этого возможен project review; схема не делает вывода об уязвимости.</desc>
+  <rect width="720" height="760" fill="#f7fafc"/>
+  <rect x="28" y="26" width="664" height="88" rx="18" fill="#123047"/>
+  <text x="56" y="64" fill="#ffffff" font-family="Arial, sans-serif" font-size="28" font-weight="700">Advisory — вход в triage, не вердикт</text>
+  <text x="56" y="92" fill="#c9e7f2" font-family="Arial, sans-serif" font-size="20">Все значения на схеме — вопросы для project review</text>
+
+  <rect x="56" y="152" width="608" height="92" rx="14" fill="#fff4d6" stroke="#c78314" stroke-width="2"/>
+  <text x="82" y="187" fill="#633d00" font-family="Arial, sans-serif" font-size="24" font-weight="700">1. External advisory</text>
+  <text x="82" y="218" fill="#633d00" font-family="Arial, sans-serif" font-size="20">package + version + source URL</text>
+  <text x="494" y="188" fill="#9b5d00" font-family="Arial, sans-serif" font-size="18" font-weight="700">SYNTHETIC</text>
+
+  <path d="M360 244 V278" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 267 L360 280 L371 267" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="306" width="282" height="124" rx="14" fill="#e5f3ff" stroke="#2774a5" stroke-width="2"/>
+  <text x="80" y="341" fill="#164766" font-family="Arial, sans-serif" font-size="23" font-weight="700">2. Lockfile</text>
+  <text x="80" y="372" fill="#164766" font-family="Arial, sans-serif" font-size="19">Есть exact package@version?</text>
+  <text x="80" y="401" fill="#164766" font-family="Arial, sans-serif" font-size="19">Это resolved tree, не runtime.</text>
+
+  <rect x="382" y="306" width="282" height="124" rx="14" fill="#e9f8ee" stroke="#2d8a54" stroke-width="2"/>
+  <text x="406" y="341" fill="#155437" font-family="Arial, sans-serif" font-size="23" font-weight="700">3. SBOM</text>
+  <text x="406" y="372" fill="#155437" font-family="Arial, sans-serif" font-size="19">Есть component record?</text>
+  <text x="406" y="401" fill="#155437" font-family="Arial, sans-serif" font-size="19">Нужна связь с build artifact.</text>
+
+  <path d="M197 430 V465 H360 V430" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M523 430 V465 H360" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 454 L360 467 L371 454" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="495" width="608" height="102" rx="14" fill="#f0ecff" stroke="#7554b8" stroke-width="2"/>
+  <text x="82" y="532" fill="#41227d" font-family="Arial, sans-serif" font-size="23" font-weight="700">4. Гипотеза достижимости</text>
+  <text x="82" y="562" fill="#41227d" font-family="Arial, sans-serif" font-size="19">entry point → import path → named scenario</text>
+  <text x="82" y="586" fill="#41227d" font-family="Arial, sans-serif" font-size="19">Не доказывает вызов уязвимой ветки.</text>
+
+  <path d="M360 597 V630" fill="none" stroke="#446276" stroke-width="4"/>
+  <path d="M349 619 L360 632 L371 619" fill="none" stroke="#446276" stroke-width="4"/>
+
+  <rect x="56" y="654" width="608" height="66" rx="14" fill="#123047"/>
+  <text x="82" y="695" fill="#ffffff" font-family="Arial, sans-serif" font-size="24" font-weight="700">Project review: evidence, owner, next check</text>
+  <text x="508" y="695" fill="#9fe2c2" font-family="Arial, sans-serif" font-size="18">не «safe»</text>
+</svg>