Secure build
Assembling images and artifacts taking into account security requirements.
Introduction
All Shturval platform components are built from source and stored in a repository in the Russian Federation. To reduce operational risk, the platform uses secure build: automated scanning at multiple stages of the build lifecycle and centralized vulnerability tracking.
Scan types in secure build
Secure build uses the following scan types:
| Type | Tools | Purpose |
|---|---|---|
| SAST (Static Application Security Testing) | Specific static analysis tools for the applied language stack | Analysis of source code for vulnerabilities and weaknesses (injections, unsafe functions, common errors). |
| SCA (Software Composition Analysis) | Dependency-Track, Syft (SBOM generation) | Checking source code dependencies for known vulnerabilities; formation of Software Bill of Materials. |
| Image Scan (Image-Scan) | Trivy | Vulnerabilities, misconfigurations and secrets in assembled container images. |
| Search for secrets (Secret Detection) | gitleaks (including pre-commit) | Prevent credentials, keys, and tokens from getting into the source code repository and container images. |
| DAST (Dynamic Application Security Testing) | OWASP ZAP | Testing while the application is running using open ports and available APIs (active testing). |
| Vulnerability Management | DefectDojo | Vulnerability accounting and management, consolidation of reports from all types of scans. |
Scan mode
Scanning is carried out daily from the moment the component version planned for inclusion in the release is selected until the release is released.
Detectable vulnerabilities at High and Critical levels:
- are eliminated when possible (updating dependencies, editing code, changing the base image);
- marked (for example, using VEX or internal platform procedures) if exploitation of the vulnerability in the context of the platform is impossible or the risk is accepted according to regulations.
Detailed reports with marked vulnerabilities by release are available in the Service Desk knowledge base.
Build process (top-level)
The top-level assembly process looks like this: selecting component versions → assembling artifacts → scanning with SAST/SCA/DAST class tools → eliminating or marking vulnerabilities → generating artifacts and placing them in the repository. The exact scheme and settings are determined by the internal regulations of the platform.
Below is a diagram of the secure assembly process (Security CI).
Below is the CVE processing cycle and the CVE summary.
