{"id":6181,"date":"2023-08-02T17:05:38","date_gmt":"2023-08-02T08:05:38","guid":{"rendered":"\/blog\/?p=6181"},"modified":"2024-01-09T09:41:44","modified_gmt":"2024-01-09T00:41:44","slug":"snyk-%ec%98%a4%ed%94%88-%ec%86%8c%ec%8a%a4-%ec%b7%a8%ec%95%bd%ec%a0%90-%ec%a7%84%eb%8b%a8-%ed%88%b4","status":"publish","type":"post","link":"https:\/\/hasu0707.duckdns.org\/blog\/?p=6181","title":{"rendered":"snyk : \uc624\ud508 \uc18c\uc2a4 \ucde8\uc57d\uc810 \uc9c4\ub2e8 \ud234"},"content":{"rendered":"\n\u25a0\uad00\ub828 \uc6a9\uc5b4
  ·IaC: \ucf54\ub4dc\ud615 \uc778\ud504\ub77c(Infrastructure as Code, IaC)
    \ud558\ub4dc\uc6e8\uc5b4 \ubc0f \uc218\ub3d9 \ud504\ub85c\uc138\uc2a4\uac00 \uc544\ub2cc \uc18c\ud504\ud2b8\uc6e8\uc5b4 \ubc0f \uc790\ub3d9\ud654\ub41c \ud504\ub85c\uc138\uc2a4\ub97c \ud1b5\ud574 \uc778\ud504\ub77c\ub97c \uad00\ub9ac\ud558\uace0 \ud504\ub85c\ube44\uc800\ub2dd\ud558\ub294 \ubc29\uc2dd.
    Snyk\uc5d0\uc11c\ub294 \uc678\ubd80 Git(SCM)\uacfc \uc5f0\ub3d9\ud558\uc5ec \uc18c\uc2a4\ucf54\ub4dc\ub97c \uc790\ub3d9\uc73c\ub85c \ub0b4\ub824\ubc1b\uc544 \uc9c4\ub2e8\ud574 \uc8fc\ub294 \ud504\ub85c\uc138\uc2a4\ub97c \uc758\ubbf8.
    https:\/\/www.vmware.com\/kr\/topics\/glossary\/content\/infrastructure-as-code.html<\/a>
    https:\/\/osbc.co.kr\/page\/oss_snyk_iac<\/a>

  ·SBOM(Software Bill Of Materials):
    \uc18c\ud504\ud2b8\uc6e8\uc5b4\uc758 \uad6c\uc131 \uc694\uc18c\ub97c \ub098\ud0c0\ub0b4\ub294 \uba54\ud0c0\ub370\uc774\ud130\ub97c \uc758\ubbf8.

\u25a0snyk \uae30\ubcf8 \uc124\uba85:
  https:\/\/snyk.io\/product\/open-source-security-management\/<\/a>

\u25a0\uc9c0\uc6d0\ud558\ub294 \uc5b8\uc5b4 \ubaa9\ub85d
  https:\/\/docs.snyk.io\/scan-using-snyk\/supported-languages-and-frameworks<\/a>

\u25a0Snyk CLI \uc2e4\ud589\uc744 \uc704\ud55c \ud658\uacbd \uc124\uc815
  https:\/\/docs.snyk.io\/snyk-cli\/configure-the-snyk-cli\/environment-variables-for-snyk-cli<\/a>

\u25a0Snyk CLI \uae30\ubcf8 \uc635\uc158 \uc815\ub9ac
  https:\/\/docs.snyk.io\/snyk-cli\/commands<\/a>

\u25a0Snyk SaaS \uc11c\ube44\uc2a4\ub97c \uc704\ud55c \ubc29\ud654\ubcbd \uc124\uc815
  https:\/\/docs.snyk.io\/snyk-cli\/security-concept-of-operations-for-snyk\/access-requirements<\/a>

\u25a0\uacb0\uacfc \ucd9c\ub825 \ud3ec\ub9f7
  https:\/\/docs.snyk.io\/snyk-cli\/scan-and-maintain-projects-using-the-cli\/cli-tools<\/a>
  Text: \uae30\ubcf8
  JSON: --json \uc635\uc158 \uc0ac\uc6a9
  HTML: snyk-to-html \ud50c\ub7ec\uadf8\uc778 \uc0ac\uc6a9

\u25a0\ub77c\uc774\uc120\uc2a4
  https:\/\/snyk.io\/plans\/<\/a>
  ·Free: $0
    Open Source: 200\ubc88 \uc9c4\ub2e8\/\uc6d4
    SAST: 100\ubc88 \uc9c4\ub2e8\/\uc6d4
  ·Team: \uac1c\ubc1c\uc790 1\uc778\ub2f9 $52\/\uc6d4
    Open Source: \ubb34\uc81c\ud55c
    SAST: \ubb34\uc81c\ud55c
    \u203bJira \ud1b5\ud569
  ·Enterprise: IaC, Container(docker, Kubernetes) \ud1b5\ud569 \ucd94\uac00 \uc120\ud0dd \uac00\ub2a5

-----------------------------------------------------------

\u25a0\uae30\ubcf8 \uc0ac\uc6a9\ubc95 \ubc0f \ud14c\uc2a4\ud2b8

  1.Download & Install Snyk CLI
    https:\/\/docs.snyk.io\/snyk-cli\/install-or-update-the-snyk-cli<\/a>

    >>\uc708\ub3c4\uc6b0 \ubc84\uc804 \ub2e4\uc6b4\ub85c\ub4dc:
    https:\/\/static.snyk.io\/cli\/latest\/snyk-win.exe<\/a>

    >>\ub9ac\ub205\uc2a4 \ubc84\uc804 \ub2e4\uc6b4\ub85c\ub4dc
    https:\/\/static.snyk.io\/cli\/latest\/snyk-linux<\/a>

    \ub2e8\uc77c \uc2e4\ud589\ud30c\uc77c\ub85c \uc124\uce58\uacfc\uc815\uc740 \ud544\uc694\uc5c6\uc73c\ub098 PATH\uc5d0\ub294 \uc7a1\ud600 \uc788\uc5b4\uc57c \ud55c\ub2e4.

  2.\uc0ac\uc6a9\uc790 \uc778\uc99d
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/auth<\/a>
    snyk auth
    \uc6f9\ube0c\ub77c\uc6b0\uc800\uac00 \ub728\uba74 Snyk\uc5d0 \ub85c\uadf8\uc778 \ud55c\ub2e4.

    \uc778\uc99d \ud1a0\ud070 \uc800\uc7a5\uc18c
      ·Linux: ~\/.config\/configstore\/snyk.json
      ·Windows: %USERPROFILE%\\.config\\configstore\\snyk.json
    \ub370\uc774\ud130 \ub514\ub809\ud1a0\ub9ac
      ·%LOCALAPPDATA%\\snyk\\snyk-cli\\<\ubc84\uc804> \uc774\ub2e4.

  3.\uc124\uce58 \ubc0f \uc815\uc0c1\uc791\ub3d9 \ud14c\uc2a4\ud2b8
    snyk test ionic

  4.SAST \uc9c4\ub2e8 \ubc29\ubc95
    https:\/\/docs.snyk.io\/snyk-cli\/getting-started-with-the-snyk-cli<\/a>
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/code<\/a>

      # \uc708\ub3c4\uc6b0 \ucee4\ub9e8\ub4dc \ucc3d\uc758 \ucf54\ub4dc\ub97c UTF-8\ub85c \ubcc0\uacbd
      CHCP 65001 1> NUL 2> NUL
      cd webgoat1
      snyk code test > result.txt

  5.\uc624\ud508\uc18c\uc2a4 \ucde8\uc57d\uc810 \uc9c4\ub2e8
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/test<\/a>

    \uc624\ud508\uc18c\uc2a4 \uc9c4\ub2e8\uc744 \uc704\ud574\uc11c\ub294 \ud574\ub2f9 \uc18c\uc2a4\ucf54\ub4dc \ud3f4\ub354\uc5d0 \uc544\ub798\uc640 \uac19\uc740 package manifest \ud30c\uc77c\uc774 \uc874\uc7ac\ud574\uc57c \ud558\uba70, maven, gradle \ub4f1\uc758 \ube4c\ub4dc\ud234\ub3c4 \ubbf8\ub9ac \uc900\ube44\ub418\uc5b4 \uc788\uc5b4\uc57c \ud55c\ub2e4.
    package.json(npm-node.js), pom.xml(Maven), composer.lock(composer)
    manifest \ud30c\uc77c\uc774 \uc900\ube44 \ub418\uc5c8\uc73c\uba74 snyk test \ucee4\ub9e8\ub4dc\ub85c \uc9c4\ub2e8\uc744 \uc2dc\uc791\ud55c\ub2e4.

    \u203b\ub9cc\uc77c manifest \ud30c\uc77c\uc774 \uc874\uc7ac\ud558\uc9c0 \uc54a\uc73c\uba74 \uc9c0\uc6d0\ud558\uc9c0 \uc54a\ub294 \uc5b8\uc5b4\ub77c\ub294 \uba54\uc138\uc9c0\ub97c \ud45c\uc2dc\ud558\uba70 \uc911\uc9c0\ub41c\ub2e4.
    \u203b\ube4c\ub4dc\uac00 \uc2e4\ud328\ud574\ub3c4 \uc9c4\ub2e8\uc774 \uc2e4\ud328\ud55c\ub2e4.

      CHCP 65001 1> NUL 2> NUL
      snyk -d test > result.txt

  6.\uacb0\uacfc\ub97c SaaS \uc11c\ubc84\uc5d0 \uc5c5\ub85c\ub4dc
    snyk monitor
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/monitor<\/a>

    \uc624\ud508 \uc18c\uc2a4 \ucde8\uc57d\uc131 \ubc0f \ub77c\uc774\uc120\uc2a4 \ubb38\uc81c\uc5d0 \ub300\ud574 \uc9c0\uc18d\uc801\uc73c\ub85c \ubaa8\ub2c8\ud130\ub9c1\ud560 Snyk \uacc4\uc815\uc5d0 \ud504\ub85c\uc81d\ud2b8\ub97c \uc0dd\uc131\ud55c\ub2e4. \ud504\ub85c\uc81d\ud2b8 \ud398\uc774\uc9c0\uc758 \uc6f9 UI\uc5d0\uc11c \ucd5c\uc2e0 \uc2a4\ub0c5\uc0f7 \ubc0f \uc2a4\uce94 \uacb0\uacfc\ub97c \ud655\uc778.
      --all-projects
        \uc791\uc5c5 \ub514\ub809\ud1a0\ub9ac\uc758 \ubaa8\ub4e0 \ud504\ub85c\uc81d\ud2b8\ub97c \uc790\ub3d9 \uac10\uc9c0.
      --org=<ORG_ID>
        ·\ud2b9\uc815 \uc870\uc9c1\uc5d0 \ub300\ud574 Snyk \uba85\ub839\uc744 \uc2e4\ud589\ud560 \uc870\uc9c1 ID\ub97c \uc9c0\uc815\ud55c\ub2e4.
        ·\ubaa8\ub2c8\ud130 \uba85\ub839\uc744 \uc2e4\ud589\ud55c \ud6c4 \uc0c8 \ud504\ub85c\uc81d\ud2b8\uac00 \uc0dd\uc131\ub418\ub294 \uc704\uce58\ub97c \uc9c0\uc815.
        ·\uc870\uc9c1\uc758 \uc124\uc815 \ud398\uc774\uc9c0(Settings > General)\uc5d0\uc11c \uc870\uc9c1 ID\ub97c \ucc3e\uc744 \uc218 \uc788\ub2e4.
      \uc608) snyk monitor --all-projects --org=81c394fb-995b-4d5d-8741-ebaaa14709d0

  7. \uc9c4\ub2e8 \uacb0\uacfc snyk \uc6f9\uc0ac\uc774\ud2b8\uc5d0\uc11c \ud655\uc778
    https:\/\/app.snyk.io\/

-----------------------------------------------------------

\u25a0snyk options
  snyk container
    \ucde8\uc57d\uc131\uc5d0 \ub300\ud55c docker \ucee8\ud14c\uc774\ub108 \uc774\ubbf8\uc9c0\ub97c \ud14c\uc2a4\ud2b8\ud569\ub2c8\ub2e4.

  snyk code
    \ud604\uc7ac \ub514\ub809\ud1a0\ub9ac\uc5d0\uc11c \uc815\uc801 \ucf54\ub4dc \ubd84\uc11d \uc9c4\ud589

  snyk sbom
    SBOM\uc744 \uc0dd\uc131\ud55c\ub2e4. (Snyk Enterprise \ub77c\uc774\uc120\uc2a4\ub9cc \uac00\ub2a5)
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/sbom<\/a>

  snyk log4shell
    Log4Shell \ucde8\uc57d\uc810\uc744 \ucc3e\ub294\ub2e4.
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/log4shell<\/a>

  snyk config
    Snyk API \uc778\uc99d \ud1a0\ud070\uacfc CLI \uc124\uc815\uc744 \ubcf4\uc5ec\uc900\ub2e4.
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/config<\/a>

  snyk policy
    \uc815\ucc45 \ud30c\uc77c\uc740 --policy-path=\/path\/test.snyk \ud615\ud0dc\ub85c \uc9c0\uc815\ud560 \uc218 \uc788\ub2e4.
    YAML \ud3ec\ub9f7\uc758 .snyk \ub85c \uc800\uc7a5\ub41c \uc815\ucc45 \ud30c\uc77c\uc774 \uc788\uc73c\uba74 \ubcf4\uc5ec\uc900\ub2e4.
    https:\/\/docs.snyk.io\/manage-risk\/policies<\/a>
    https:\/\/docs.snyk.io\/manage-risk\/policies\/the-.snyk-file<\/a>

    .snyk \uc815\ucc45\uc73c\ub85c \ud560 \uc218 \uc788\ub294 \uc77c
      \uc18c\uc2a4\uc758 \ud2b9\uc815 \ud30c\uc77c \ub610\ub294 \ud3f4\ub354 \uc81c\uc678
      \uc5b8\uc5b4\uc758 \ubc84\uc804 \uc815\uc758
      \ud2b9\uc815 \ucde8\uc57d\uc810 \uc608\uc678 \ucc98\ub9ac

  snyk ignore
    \ud2b9\uc815 \uc774\uc288\ub97c \ubb34\uc2dc\ud558\ub3c4\ub85d \uc124\uc815\ud55c\ub2e4. (\ud3ec\ud2f0\ud30c\uc774\uc5d0\uc11c Suppress \uac19\uc740 \uac83)
    https:\/\/docs.snyk.io\/snyk-cli\/commands\/ignore<\/a>

  Debug logs: -d<\/span>\n","protected":false},"excerpt":{"rendered":"

\u25a0\uad00\ub828 \uc6a9\uc5b4  ·IaC: \ucf54\ub4dc\ud615 \uc778\ud504\ub77c(Infrastructure as Code, IaC)    \ud558\ub4dc\uc6e8\uc5b4 \ubc0f \uc218\ub3d9 \ud504\ub85c\uc138\uc2a4\uac00 \uc544\ub2cc \uc18c\ud504\ud2b8\uc6e8\uc5b4 \ubc0f \uc790\ub3d9\ud654\ub41c \ud504\ub85c\uc138\uc2a4\ub97c \ud1b5\ud574 \uc778\ud504\ub77c\ub97c \uad00\ub9ac\ud558\uace0 \ud504\ub85c\ube44\uc800\ub2dd\ud558\ub294 \ubc29\uc2dd.    Snyk\uc5d0\uc11c\ub294 \uc678\ubd80 Git(SCM)\uacfc \uc5f0\ub3d9\ud558\uc5ec \uc18c\uc2a4\ucf54\ub4dc\ub97c \uc790\ub3d9\uc73c\ub85c \ub0b4\ub824\ubc1b\uc544 \uc9c4\ub2e8\ud574 \uc8fc\ub294 \ud504\ub85c\uc138\uc2a4\ub97c \uc758\ubbf8.    https:\/\/www.vmware.com\/kr\/topics\/glossary\/content\/infrastructure-as-code.html    https:\/\/osbc.co.kr\/page\/oss_snyk_iac   ·SBOM(Software Bill Of Materials):    \uc18c\ud504\ud2b8\uc6e8\uc5b4\uc758 \uad6c\uc131 \uc694\uc18c\ub97c \ub098\ud0c0\ub0b4\ub294 \uba54\ud0c0\ub370\uc774\ud130\ub97c \uc758\ubbf8. \u25a0snyk \uae30\ubcf8 \uc124\uba85:  https:\/\/snyk.io\/product\/open-source-security-management\/ […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[12],"tags":[],"class_list":["post-6181","post","type-post","status-publish","format-standard","hentry","category-computing_security"],"_links":{"self":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6181"}],"version-history":[{"count":0,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6181\/revisions"}],"wp:attachment":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}