68 lines
2.2 KiB
Markdown
68 lines
2.2 KiB
Markdown
---
|
||
title: "Supply Chain Security"
|
||
type: concept
|
||
tags: [Supply-Chain-Security, Software-Supply-Chain, DevSecOps, OpenText, Project-Thor, SBOM]
|
||
sources:
|
||
- public-cloud-learning-sessions-opentext-thor-platform-flows-20241210-160056-meet
|
||
- ctp-topic-21-supply-chain-security-in-micro-focus
|
||
last_updated: 2026-05-11
|
||
---
|
||
|
||
## Supply Chain Security
|
||
|
||
Supply Chain Security（供应链安全）是软件工程领域的核心安全实践，涵盖从源代码到客户交付全链路的安全性、可信赖性和可追溯性。OpenText 通过 Project Thor 将供应链安全作为工具链治理的核心理念。
|
||
|
||
## Aliases
|
||
- Supply Chain Security
|
||
- 软件供应链安全
|
||
- Supply Chain Security (SCS)
|
||
|
||
## Key Facts
|
||
|
||
| 维度 | 说明 |
|
||
|------|------|
|
||
| 核心要素 | 源代码（Source Code）作为供应链核心 IP |
|
||
| 管理平台 | GitLab（集中化源代码控制） |
|
||
| 标准化工具 | GitLab + Artifactory + UCMDB |
|
||
| OpenText 战略 | Project Thor 五大支柱之一 |
|
||
| 目标 | 全链路可追溯、防篡改、安全合规 |
|
||
|
||
## 供应链数据流
|
||
|
||
```
|
||
GitLab（源代码 / IP）
|
||
↓
|
||
Build Farms（制造流程）
|
||
↓ Code Signing（签名验证）
|
||
Artifactory（制品仓库）
|
||
↓
|
||
客户环境
|
||
```
|
||
|
||
Arnold Dacan 的核心观点：
|
||
|
||
> "The main ingredient in the supply chain is our source code, our IP that is intended to live in GitLab."
|
||
|
||
## Project Thor 中的定位
|
||
|
||
Supply Chain Security 是 [[Project-Thor]] 五大支柱之一（安全与治理支柱），与以下实践紧密关联：
|
||
|
||
- [[Code-Signing]]：构建产物签名验证
|
||
- [[GitLab]]：源代码集中化管理
|
||
- [[Artifactory]]：制品仓库安全存储
|
||
- [[UCMDB]]：配置管理可追溯性
|
||
- [[GitLab-Geo]]：灾备与业务连续性
|
||
|
||
## Connections
|
||
|
||
- [[Supply-Chain-Security]] ← core_principle ← [[Project-Thor]]
|
||
- [[Supply-Chain-Security]] ← protects ← 源代码（GitLab 作为核心 IP）
|
||
- [[Supply-Chain-Security]] ← implements ← [[Code-Signing]]
|
||
- [[Supply-Chain-Security]] ← stores ← [[Artifactory]]
|
||
- [[Supply-Chain-Security]] ← relates_to ← [[DevSecOps]]
|
||
|
||
## Sources
|
||
|
||
- [[public-cloud-learning-sessions-opentext-thor-platform-flows-20241210-160056-meet]]
|
||
- [[ctp-topic-21-supply-chain-security-in-micro-focus]]
|