Software development management method based on DevSecOps platform

Abstract

The present application discloses a software development management method based on a DevSecOps platform, which relates to the field of software development. The method utilizes the continuous deployment tool of the DevSecOps platform to deploy a simulated operating environment that matches the chip architecture targeted by the software to be developed through a qemu-based docker image, and then implements continuous integration and deployment in the simulated operating environment, so that software of a general software stack that is not based on a general chip architecture can also utilize the DevSecOps platform to achieve rapid iterative development, which fills the technical gap and expands the application scope of the DevSecOps platform.

Description

Technical Field

[0001] The present application relates to the field of software development, and in particular to a software development management method based on a DevSecOps platform. Background Art

[0002] Traditional software organizations set up development, testing, and operation and maintenance as separate departments. The delivered software products need to be processed in one department before they can be transferred to the next department. This model makes it impossible to discover problems with software products early, which lengthens the iteration cycle of software products.

[0003] DevOps is a general term for a set of processes, methods and systems, which are mainly used to promote communication, collaboration and rectification among development, technical operations and quality assurance departments. Software development management through the DevOps platform can make building, testing and releasing software faster, more frequent and more reliable, thereby achieving continuous integration, continuous deployment and continuous delivery. Compared with traditional development management methods, it can speed up the iterative development of software products.

[0004] Since traditional DevOps does not focus on security testing, and information security is increasingly valued, DevSecOps platforms are created by integrating security testing into existing DevOps processes. DevSecOps platforms automatically implement security measures at each stage of the software development lifecycle, supporting the development of secure platforms with agile methods and DevOps speed. They have been widely practiced in the field of software development and have achieved good results. However, DevSecOps platforms are only applicable to software development of general software stacks based on the x86 chip architecture, which greatly limits the application of DevSecOps platforms in the field of software development. Summary of the invention

[0005] In response to the above problems and technical requirements, the applicant has proposed a software development management method based on the DevSecOps platform. The technical solution of this application is as follows:

[0006] A software development management method based on a DevSecOps platform, the method comprising:

[0007] Use the continuous deployment tool of the DevSecOps platform to obtain a simulated docker image, start the simulated docker image and trigger the start of the qemu image deployment to obtain a simulated operating environment that matches the chip architecture targeted by the software to be developed. The chip architecture targeted by the software to be developed is a chip architecture other than the general chip architecture supported by the DevSecOps platform.

[0008] Use the continuous integration tools of the DevSecOps platform to perform development management tasks on the software development code of the software to be developed and the simulated operating environment obtained through deployment to obtain the products and upload them to the product library;

[0009] Use the continuous deployment tool of the DevSecOps platform to obtain artifacts from the artifact library and complete the deployment based on the simulated operating environment obtained through deployment.

[0010] Its further technical solution is that the method further comprises:

[0011] Use the continuous deployment tool of the DevSecOps platform to obtain the general Docker image, start the deployment of the general Docker image to obtain the general operating environment;

[0012] The method for producing the product includes: executing part of the development management tasks on the software development code in the deployed simulated operating environment, and executing other tasks of the development management tasks on the software development code in the deployed general operating environment;

[0013] Among them, the general operating environment supports the development of software to be developed for the general chip architecture, but does not support the development of software to be developed for other chip architectures besides the general chip architecture.

[0014] A further technical solution is that the method for producing the product comprises:

[0015] In the deployed simulated operating environment, some tasks that need to be compiled and run in the development management tasks are executed on the software development code, and other tasks that do not need to be compiled and run in the development management tasks are executed on the software development code in the deployed general operating environment.

[0016] Its further technical solution is that some tasks that need to be compiled and run include static security scanning tasks, white box testing tasks and unit testing tasks, and other tasks that do not need to be compiled and run include code specification scanning tasks.

[0017] Its further technical solution is that the general chip architecture is the x86 chip architecture, and other chip architectures outside the general chip architecture are non-x86 chip architectures.

[0018] Its further technical solution is that the qemu image and the startup script are packaged in the simulated docker image, and the startup script contains the execution instruction of starting the qemu image.

[0019] Its further technical solution is that the method of starting the simulated docker image and triggering the start of the qemu image deployment to obtain the simulated operating environment includes:

[0020] Start the simulated docker image and run the startup script to trigger the start of the qemu image in the simulated docker image to create a simulated operating environment.

[0021] Its further technical solution is that a download and run script is packaged in the simulated docker image, and the download and run script contains the download address of the qemu image and the execution instructions for downloading the qemu image from the download address and starting it.

[0022] Its further technical solution is that the method of starting the simulated docker image and triggering the start of the qemu image deployment to obtain the simulated operating environment includes:

[0023] Start the simulated docker image and run the download and run script to trigger the download of the qemu image from the download address of the qemu image and start it to create a simulated running environment.

[0024] Its further technical solution is that the method further comprises:

[0025] When the simulated operating environment that matches the chip architecture targeted by the software to be developed changes, the continuous deployment tool of the DevSecOps platform is used to redeploy the simulated operating environment that matches the chip architecture targeted by the software to be developed.

[0026] The beneficial technical effects of this application are:

[0027] The present application discloses a software development management method based on a DevSecOps platform. The method utilizes the continuous deployment tool of the DevSecOps platform to deploy a simulated operating environment that matches the chip architecture targeted by the software to be developed through a qemu-based docker image, so that software of a general software stack that is not based on a general chip architecture can also be developed using the DevSecOps platform, thereby expanding the application scope of the DevSecOps platform and enabling software to be developed of a general software stack that is not based on a general chip architecture to be developed using the DevSecOps platform for rapid iterative development.

[0028] In addition, this method combines the simulation operating environment and the general operating environment. It not only uses the simulation operating environment to match the chip architecture, but also combines it with the high performance of the general operating environment. On the basis of the implementation of the development management method, it can further accelerate the speed of continuous integration and thus accelerate the speed of iterative development. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a flowchart of using the DevSecOps platform to perform software development management based on a simulated operating environment in an embodiment of the present application.

[0030] Figure 2 It is a flowchart of another embodiment of using the DevSecOps platform to manage software development based on a method combining a simulated operating environment and a general operating environment. DETAILED DESCRIPTION

[0031] The specific implementation of the present application is further described below in conjunction with the accompanying drawings.

[0032] The present application discloses a software development management method based on a DevSecOps platform, wherein the software to be developed by the method is software suitable for chip architectures other than the general chip architecture supported by the DevSecOps platform. The detection and operation environment of the software in the DevSecOps platform is often a cloud environment based on Docker, which is suitable for software development of a general software stack based on a general chip architecture. However, for software to be developed for other chip architectures, due to the problem of instruction sets, this cloud environment in the DevSecOps platform cannot be directly used, resulting in the current inability to use the DevSecOps platform to develop and manage such software to be developed.

[0033] This application provides a method that enables the development and management of such software to be developed using the DevSecOps platform, expanding the scope of the DevSecOps platform. For software with a general chip architecture supported by the DevSecOps platform, development and management can be performed directly according to existing conventional methods. This application will not introduce the development and management process of software for a general chip architecture in the future. In actual application, the general chip architecture is the x86 chip architecture, and other chip architectures outside the general chip architecture are non-x86 chip architectures, such as the ARM chip architecture or other types of self-developed chip architectures.

[0034] The method provided in this application comprises the following steps:

[0035] Step S1, using the continuous deployment tool of the DevSecOps platform to obtain a simulated docker image, start the simulated docker image and trigger the start of the qemu image deployment to obtain a simulated operating environment that matches the chip architecture targeted by the software to be developed.

[0036] The chip architecture targeted by the software to be developed here is a chip architecture other than the general chip architecture supported by the DevSecOps platform. It can be the ARM chip architecture mentioned above or other types of self-developed chip architectures. This application does not limit this.

[0037] In one embodiment, a qemu image and a startup script are packaged in the simulated docker image, and the startup script includes an execution instruction for starting the qemu image. In this embodiment, when the simulated docker image is started, the startup script will be automatically run, thereby triggering the startup of the qemu image in the simulated docker image, and a simulated operating environment can be created. In addition, the simulated docker image and the qemu image packaged therein are pre-port mapped and directory mapped, and the qemu image in the simulated docker image can directly use the internal port mapped by the simulated docker image startup when starting.

[0038] In another embodiment, since the qemu image is often relatively large, if the qemu image is directly packaged into the simulated docker image, the simulated docker image will appear to be very bloated. Therefore, in order to simplify the simulated docker image, in this embodiment, the simulated docker image does not directly contain the qemu image, but is packaged with a download and run script, which contains the download address of the qemu image and the execution instructions for downloading the qemu image from the download address and starting it. In this embodiment, when the simulated docker image is started, the download and run script will be automatically run, thereby triggering the download and start of the qemu image from the download address of the qemu image, thereby creating a simulated operating environment. In this embodiment, the port mapping and directory mapping between the simulated docker image and the qemu image are generally pre-specified in the download and run script, and the internal port of the simulated docker image startup mapping can be directly used when the qemu image is downloaded and started. Step S2, using the continuous integration tool of the DevSecOps platform to perform development management tasks on the software development code of the software to be developed and the simulated operating environment obtained based on the deployment to obtain the product and upload the product library.

[0039] The operational process of development management tasks performed on the software development code of the software to be developed is similar to the conventional application of the DevSecOps platform, including: R&D personnel submit the software development code to the git system after completing local development, and then the git system triggers Jenkins detection through webhooks. Jenkins calls the Jenkins node on the cloud resource platform through the pipeline to perform corresponding construction and scanning, and then compiles, scans, runs unit tests and performs corresponding access control indicators on the software development code to produce products and upload them to the product library.

[0040] Step S3, using the continuous deployment tool of the DevSecOps platform to obtain the artifact from the artifact library and complete the deployment based on the deployed simulated operating environment, that is, to create an instance corresponding to the artifact in the deployed simulated operating environment.

[0041] Based on the above method provided by the present application, considering that qemu itself is a device simulation environment, its performance is much worse than that of docker. Therefore, in another embodiment, a method combining a simulated operating environment with a general operating environment is adopted. That is, in addition to using the continuous deployment tool of the DevSecOps platform to obtain a simulated docker image to deploy a simulated operating environment, the method also uses the continuous deployment tool of the DevSecOps platform to obtain a general docker image, and starts the deployment of the general docker image to obtain a general operating environment. The general operating environment supports the development of software to be developed for a general chip architecture, but does not support the development of software to be developed for other chip architectures other than the general chip architecture. It is an existing DevSecOps platform that implements detection of x86 software and a docker-based cloud environment during runtime.

[0042] When the continuous integration tool of the DevSecOps platform is used to execute the development management task on the software development code of the software to be developed to obtain the product, some tasks in the development management task are executed on the software development code in the deployed simulated operating environment, and other tasks in the development management task are executed on the software development code in the deployed general operating environment. Further in this embodiment, some tasks in the development management task that need to be compiled and run are executed on the software development code in the deployed simulated operating environment, and other tasks in the development management task that do not need to be compiled and run are executed on the software development code in the deployed general operating environment. Combined with the various development management tasks actually performed, some tasks that need to be compiled and run include static security scanning tasks (SAST), white box testing tasks (Fuzzing) and unit testing tasks, and other tasks that do not need to be compiled and run include code specification scanning tasks.

[0043] That is, in this embodiment, some tasks that need to be compiled and run are run in a simulated running environment to match the chip architecture for the software to be developed, and some tasks that do not need to be compiled and run are run in a general running environment to improve performance. Compared with the method in which all development and management tasks are run in a simulated running environment, the speed of continuous integration can be further accelerated, thereby speeding up iterative development.

[0044] After the simulated operating environment is deployed, the DevSecOps platform can be used to continuously integrate, continuously deploy, and continuously deliver the software to be developed. When the simulated operating environment that matches the chip architecture targeted by the software to be developed changes, the DevSecOps platform's continuous deployment tool can be used to redeploy the simulated operating environment that matches the chip architecture targeted by the software to be developed, that is, to update the simulated operating environment to match the chip architecture targeted by the software to be developed in real time.

[0045] The above is only a preferred embodiment of the present application, and the present application is not limited to the above embodiments. It is understood that other improvements and changes directly derived or associated by those skilled in the art without departing from the spirit and concept of the present application should be considered to be included in the protection scope of the present application.

Claims

1. A software development management method based on DevSecOps platform, characterized in that: The method comprises: Using the continuous deployment tool of the DevSecOps platform to obtain a simulated docker image, start the simulated docker image and trigger the start of the qemu image deployment to obtain a simulated operating environment that matches the chip architecture targeted by the software to be developed, where the chip architecture targeted by the software to be developed is a chip architecture other than the general chip architecture supported by the DevSecOps platform; using the continuous deployment tool of the DevSecOps platform to obtain a general docker image, start the general docker image deployment to obtain a general operating environment; Utilize the continuous integration tool of the DevSecOps platform to execute the development management task on the software development code of the software to be developed and the simulated operating environment obtained by deployment to obtain the product and upload it to the product library; the method for producing the product includes: executing part of the development management task on the software development code in the simulated operating environment obtained by deployment, and executing other tasks of the development management task on the software development code in the general operating environment obtained by deployment; wherein the general operating environment supports the development of the software to be developed for the general chip architecture, but does not support the development of the software to be developed for other chip architectures other than the general chip architecture; The continuous deployment tool of the DevSecOps platform is used to obtain artifacts from the artifact library and complete the deployment based on the simulated operating environment obtained by deployment.

2. The method according to claim 1, characterized in that The method for making the product includes: In the deployed simulated operating environment, some tasks that need to be compiled and run in the development management tasks are executed on the software development code, and other tasks that do not need to be compiled and run in the development management tasks are executed on the software development code in the deployed general operating environment.

3. The method according to claim 2, characterized in that Some tasks that need to be compiled and run include static security scanning tasks, white box testing tasks, and unit testing tasks. Other tasks that do not need to be compiled and run include code specification scanning tasks.

4. The method according to claim 1, characterized in that The general chip architecture is the x86 chip architecture, and other chip architectures outside the general chip architecture are non-x86 chip architectures.

5. The method according to claim 1, characterized in that The simulated docker image is packaged with a qemu image and a startup script, and the startup script contains an execution instruction for starting the qemu image.

6. The method according to claim 5, characterized in that The method of starting the simulated docker image and triggering the start of the qemu image deployment to obtain the simulated operating environment includes: The simulated docker image is started, and the startup script is run to trigger the startup of the qemu image in the simulated docker image, so as to create the simulated running environment.

7. The method according to claim 1, characterized in that The simulated docker image is packaged with a download and run script, which includes a download address of the qemu image and an execution instruction for downloading the qemu image from the download address and starting it.

8. The method according to claim 7, characterized in that The method of starting the simulated docker image and triggering the start of the qemu image deployment to obtain the simulated operating environment includes: Start the simulated docker image, run the download and run script to trigger the download of the qemu image from the download address of the qemu image and start it, and create the simulated running environment.

9. The method according to claim 1, characterized in that: The method further comprises: When the simulated operating environment that matches the chip architecture targeted by the software to be developed changes, the continuous deployment tool of the DevSecOps platform is used to redeploy the simulated operating environment that matches the chip architecture targeted by the software to be developed.

Images