A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik risklerini de getiriyor. Peki, kulland\u0131\u011f\u0131n\u0131z a\u00e7\u0131k kaynak bile\u015fenlerinin ger\u00e7ekten g\u00fcvende oldu\u011fundan ve \u00fczerinde oynanmad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? GitHub’\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini sa\u011flamada kritik bir rol oynar. Bu makalede, GitHub’\u0131n bu g\u00fc\u00e7l\u00fc \u00f6zelli\u011finin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden bu kadar \u00f6nemli oldu\u011funu ve projelerinizi siber sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilece\u011finizi ad\u0131m ad\u0131m ke\u015ffedece\u011fiz. Ba\u015flamak i\u00e7in haz\u0131r m\u0131s\u0131n\u0131z?<\/p>\n
G\u00fcn\u00fcm\u00fcz yaz\u0131l\u0131m geli\u015ftirme ekosisteminde, projelerin b\u00fcy\u00fck bir \u00e7o\u011funlu\u011fu a\u00e7\u0131k kaynak bile\u015fenlerine dayanmaktad\u0131r. Bu bile\u015fenler, geli\u015ftirme s\u00fcre\u00e7lerini h\u0131zland\u0131r\u0131r ve inovasyonu te\u015fvik eder. Ancak bu kolayl\u0131k, “tedarik zinciri” olarak adland\u0131r\u0131lan yeni bir g\u00fcvenlik vekt\u00f6r\u00fcn\u00fc de beraberinde getirir. Bir uygulaman\u0131n kulland\u0131\u011f\u0131 y\u00fczlerce hatta binlerce \u00fc\u00e7\u00fcnc\u00fc taraf k\u00fct\u00fcphane ve ba\u011f\u0131ml\u0131l\u0131k g\u00f6z \u00f6n\u00fcne al\u0131nd\u0131\u011f\u0131nda, bunlardan herhangi birindeki tek bir zafiyet, t\u00fcm sistemi riske atabilir. \u00d6rne\u011fin, Log4Shell gibi yak\u0131n zamanda ya\u015fanan b\u00fcy\u00fck g\u00fcvenlik olaylar\u0131, pop\u00fcler bir a\u00e7\u0131k kaynak k\u00fct\u00fcphanesindeki bir a\u00e7\u0131\u011f\u0131n ne kadar geni\u015f \u00e7apl\u0131 bir y\u0131k\u0131ma yol a\u00e7abilece\u011fini g\u00f6zler \u00f6n\u00fcne sermi\u015ftir.<\/p>\n
Tedarik zinciri sald\u0131r\u0131lar\u0131 genellikle \u00fc\u00e7 ana \u015fekilde ortaya \u00e7\u0131kar: ilk olarak, geli\u015ftirme ortam\u0131na s\u0131zarak k\u00f6t\u00fc niyetli kod enjekte etmek; ikinci olarak, paket y\u00f6neticileri arac\u0131l\u0131\u011f\u0131yla da\u011f\u0131t\u0131lan yaz\u0131l\u0131m paketlerine m\u00fcdahale etmek; ve \u00fc\u00e7\u00fcnc\u00fc olarak, yaz\u0131l\u0131m g\u00fcncelleme mekanizmalar\u0131n\u0131 ele ge\u00e7irmek. Bu t\u00fcr sald\u0131r\u0131lar, genellikle yaz\u0131l\u0131m\u0131n orijinal yazar\u0131ndan son kullan\u0131c\u0131ya ula\u015fana kadar ge\u00e7en s\u00fcre\u00e7teki zay\u0131f halkalar\u0131 hedefler. Bir paketin g\u00fcvenli\u011fi sadece kendi i\u00e7indeki kodun kalitesiyle de\u011fil, ayn\u0131 zamanda o paketin nas\u0131l olu\u015fturuldu\u011fu, imzaland\u0131\u011f\u0131, depoland\u0131\u011f\u0131 ve da\u011f\u0131t\u0131ld\u0131\u011f\u0131 s\u00fcre\u00e7lerin tamam\u0131yla belirlenir. Bu nedenle, a\u00e7\u0131k kaynak projeler i\u00e7in g\u00fc\u00e7l\u00fc bir tedarik zinciri g\u00fcvenli\u011fi stratejisi olu\u015fturmak, sadece bir ‘g\u00fczel olsa’ \u00f6zelli\u011fi de\u011fil, zorunlu bir ihtiya\u00e7t\u0131r. Aksi takdirde, milyonlarca kullan\u0131c\u0131n\u0131n verileri veya sistemleri tehlikeye girebilir.<\/p>\n
GitHub gibi platformlar, a\u00e7\u0131k kaynak projelerin bar\u0131nd\u0131r\u0131lmas\u0131 ve i\u015fbirli\u011fi i\u00e7in merkezi bir konum sa\u011flad\u0131\u011f\u0131ndan, bu platformlarda uygulanan g\u00fcvenlik mekanizmalar\u0131 do\u011frudan binlerce projenin ve dolay\u0131s\u0131yla milyonlarca uygulaman\u0131n g\u00fcvenli\u011fini etkiler. De\u011fi\u015fmez s\u00fcr\u00fcmler (immutable releases), bu karma\u015f\u0131k tedarik zinciri bulmacas\u0131nda \u00f6nemli bir par\u00e7ay\u0131 temsil eder. Bu, bir yaz\u0131l\u0131m\u0131n belirli bir s\u00fcr\u00fcm\u00fcn\u00fcn bir kez yay\u0131nland\u0131ktan sonra de\u011fi\u015ftirilemez olmas\u0131n\u0131 sa\u011flamak anlam\u0131na gelir. B\u00f6ylece, kullan\u0131c\u0131lar indirdikleri yaz\u0131l\u0131m\u0131n orijinal yazar\u0131n\u0131n yay\u0131nlad\u0131\u011f\u0131 s\u00fcr\u00fcmle tamamen ayn\u0131 oldu\u011fundan emin olabilirler. G\u00fcvenli\u011fin bu kadar kritik oldu\u011fu bir \u00e7a\u011fda, yaz\u0131l\u0131m\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve orijinalli\u011fini garanti alt\u0131na almak, geli\u015ftiricilerin ve son kullan\u0131c\u0131lar\u0131n i\u00e7ini rahatlatan bir g\u00fcvencedir.<\/p>\n
GitHub’daki “de\u011fi\u015fmez s\u00fcr\u00fcm” kavram\u0131, yay\u0131nlanan bir yaz\u0131l\u0131m paketinin veya ikili dosyan\u0131n, bir kez olu\u015fturulduktan sonra i\u00e7eri\u011finin de\u011fi\u015ftirilemeyece\u011fi anlam\u0131na gelir. Bu, yaz\u0131l\u0131m\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve kimli\u011fini do\u011frulamak i\u00e7in kritik bir \u00f6zelliktir. Temelde, GitHub s\u00fcr\u00fcmleri (releases), bir Git etiketine (tag) ba\u011fl\u0131d\u0131r ve bu etiketler belirli bir taahh\u00fcd\u00fc (commit) i\u015faret eder. Git’in kendisi, kriptografik karmalar (hash) kullanarak ge\u00e7mi\u015fteki t\u00fcm de\u011fi\u015fikliklerin ve s\u00fcr\u00fcmlerin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc koruyan da\u011f\u0131t\u0131lm\u0131\u015f bir s\u00fcr\u00fcm kontrol sistemidir. Yani, bir kez bir commit olu\u015fturuldu\u011funda ve bir etiket o commite i\u015faret etti\u011finde, o commit’in i\u00e7eri\u011fi de\u011fi\u015ftirilemez.<\/p>\n
Bir GitHub s\u00fcr\u00fcm\u00fc olu\u015fturuldu\u011funda, genellikle ilgili Git etiketi i\u015faretlenir ve bu etikete ek olarak ikili dosyalar (binaries), kaynak kod ar\u015fivleri ve di\u011fer varl\u0131klar (assets) y\u00fcklenebilir. Bu varl\u0131klar da GitHub’\u0131n depolama mekanizmas\u0131 taraf\u0131ndan y\u00f6netilir ve genellikle \u00fczerlerinde bir karma (checksum) de\u011feri bulunur. Bu karma, dosyan\u0131n parmak izi gibidir ve dosyan\u0131n i\u00e7eri\u011fi de\u011fi\u015fti\u011finde bu karma da de\u011fi\u015fir. Bir s\u00fcr\u00fcm bir kez yay\u0131nland\u0131ktan sonra, o s\u00fcr\u00fcmle ili\u015fkili dosyalar\u0131n i\u00e7eri\u011fini do\u011frudan de\u011fi\u015ftirmek m\u00fcmk\u00fcn de\u011fildir. E\u011fer bir de\u011fi\u015fiklik yap\u0131lmas\u0131 gerekiyorsa, yeni bir s\u00fcr\u00fcm olu\u015fturulmas\u0131 gerekir. Bu da eski s\u00fcr\u00fcm\u00fcn b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korurken, yeni s\u00fcr\u00fcm\u00fcn kendi ba\u011f\u0131ms\u0131z kimli\u011fine sahip olmas\u0131n\u0131 sa\u011flar.<\/p>\n
Bu s\u00fcre\u00e7, yaz\u0131l\u0131m tedarik zincirinde \u00f6nemli bir g\u00fcvenlik katman\u0131 olu\u015fturur. \u00d6rne\u011fin, k\u00f6t\u00fc niyetli bir akt\u00f6r, bir projenin yay\u0131nlanm\u0131\u015f s\u00fcr\u00fcm\u00fcndeki ikili dosyalar\u0131 manip\u00fcle etmeye \u00e7al\u0131\u015fsa bile, GitHub’\u0131n altyap\u0131s\u0131 bu de\u011fi\u015fikli\u011fe izin vermeyecektir. E\u011fer bir \u015fekilde eski s\u00fcr\u00fcm\u00fcn i\u00e7eri\u011fi de\u011fi\u015ftirilse dahi, dosyalar\u0131n karmalar\u0131 orijinal karmalarla e\u015fle\u015fmeyece\u011fi i\u00e7in bu durum kolayca tespit edilebilir. Bu, \u00f6zellikle ba\u011f\u0131ml\u0131l\u0131klar\u0131 y\u00fckleyen veya otomatik g\u00fcncelleme yapan CI\/CD sistemleri i\u00e7in hayati \u00f6nem ta\u015f\u0131r. Bu sistemler, indirdikleri paketlerin karman\u0131n beklenen de\u011ferle uyu\u015ftu\u011funu kontrol ederek, herhangi bir tahrifat\u0131n \u00f6n\u00fcne ge\u00e7ebilirler. Bu sayede, geli\u015ftiriciler ve kullan\u0131c\u0131lar, indirdikleri her yaz\u0131l\u0131m par\u00e7as\u0131n\u0131n, projenin yarat\u0131c\u0131s\u0131 taraf\u0131ndan onaylanm\u0131\u015f ve de\u011fi\u015ftirilmemi\u015f hali oldu\u011fundan emin olabilirler.<\/p>\n
Ayr\u0131ca, GitHub, kullan\u0131c\u0131lar\u0131n yay\u0131nlad\u0131klar\u0131 Git etiketlerini GPG (GNU Privacy Guard) anahtarlar\u0131yla imzalamas\u0131na olanak tan\u0131r. Bu dijital imza, etiketi olu\u015fturan\u0131n ger\u00e7ekten beklenen geli\u015ftirici oldu\u011funu kan\u0131tlar ve herhangi bir manip\u00fclasyonun tespiti i\u00e7in ek bir katman sa\u011flar. Yani, sadece s\u00fcr\u00fcm\u00fcn i\u00e7eri\u011finin de\u011fi\u015ftirilemez olmas\u0131 de\u011fil, ayn\u0131 zamanda o s\u00fcr\u00fcm\u00fc kimin olu\u015fturdu\u011funun da do\u011frulanabilir olmas\u0131, a\u00e7\u0131k kaynak g\u00fcvenli\u011finde kritik bir ad\u0131md\u0131r. Bu kombinasyon, GitHub immutable releases’\u0131 a\u00e7\u0131k kaynak tedarik zinciri sald\u0131r\u0131lar\u0131na kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir savunma mekanizmas\u0131 haline getirir.<\/p>\n
G\u00fcvenli ve de\u011fi\u015fmez bir GitHub s\u00fcr\u00fcm\u00fc olu\u015fturmak, projenizin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc garanti alt\u0131na alman\u0131n temel ad\u0131mlar\u0131ndan biridir. Bu s\u00fcre\u00e7, sadece kodunuzu bir etiketle i\u015faretlemekten \u00e7ok daha fazlas\u0131n\u0131 i\u00e7erir; ayn\u0131 zamanda o s\u00fcr\u00fcm\u00fcn kimli\u011fini ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc do\u011frulamaya y\u00f6nelik ad\u0131mlar\u0131 da kapsar. \u0130\u015fte ad\u0131m ad\u0131m nas\u0131l yapabilece\u011finiz:<\/p>\n
\u0130lk olarak, s\u00fcr\u00fcm\u00fcn\u00fcze kar\u015f\u0131l\u0131k gelen bir Git etiketi olu\u015fturman\u0131z gerekir. G\u00fcvenlik i\u00e7in, bu etiketi GPG anahtar\u0131n\u0131zla imzalaman\u0131z \u015fiddetle tavsiye edilir. \u0130mzal\u0131 etiketler, etiket sahibinin kimli\u011fini do\u011frular ve olas\u0131 bir kurcalamay\u0131 engeller.<\/p>\n
\n # Bir GPG anahtar\u0131 olu\u015fturdu\u011funuzdan ve Git ile yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun.\n # Mevcut commit'e bir etiket olu\u015fturma ve imzalama:\n git tag -s v1.0.0 -m \"S\u00fcr\u00fcm 1.0.0\"\n # Etiketi uzak depoya g\u00f6nderme:\n git push origin v1.0.0\n<\/pre>\n<\/code><\/p>\n
Bu komutlar, projenizin mevcut durumunu \"v1.0.0\" olarak etiketler ve bu etiketi GPG anahtar\u0131n\u0131zla kriptografik olarak imzalar. Daha sonra bu imzal\u0131 etiketi GitHub'a g\u00f6nderirsiniz. Unutmay\u0131n, GPG anahtar\u0131n\u0131z\u0131n genel k\u0131sm\u0131n\u0131 GitHub hesab\u0131n\u0131za eklemeniz, imzan\u0131z\u0131n do\u011frulanabilmesi i\u00e7in \u00f6nemlidir.<\/p>\n
Ad\u0131m 2: GitHub Web Aray\u00fcz\u00fcnden Bir S\u00fcr\u00fcm Yay\u0131mlay\u0131n<\/h3>\n
Etiketi GitHub'a g\u00f6nderdikten sonra, web aray\u00fcz\u00fc \u00fczerinden bu etikete ba\u011fl\u0131 bir s\u00fcr\u00fcm olu\u015fturabilirsiniz:<\/p>\n
\n- Projenizin GitHub deposuna gidin.<\/li>\n
- \"Code\" sekmesinin alt\u0131ndaki \"Releases\" b\u00f6l\u00fcm\u00fcne t\u0131klay\u0131n.<\/li>\n
- \"Draft a new release\" veya \"Create a new release\" d\u00fc\u011fmesine t\u0131klay\u0131n.<\/li>\n
- \"Choose a tag\" a\u00e7\u0131l\u0131r men\u00fcs\u00fcnden yeni olu\u015fturdu\u011funuz etiketi (\u00f6rne\u011fin,
v1.0.0<\/code>) se\u00e7in.<\/li>\n- S\u00fcr\u00fcm ba\u015fl\u0131\u011f\u0131 ve a\u00e7\u0131klamas\u0131n\u0131 girin. Bu a\u00e7\u0131klama, s\u00fcr\u00fcm\u00fcn\u00fczdeki \u00f6nemli de\u011fi\u015fiklikleri ve yeni \u00f6zellikleri \u00f6zetlemelidir.<\/li>\n
- Varl\u0131k Y\u00fckleme (Asset Upload):<\/strong> E\u011fer projenizin derlenmi\u015f ikili dosyalar\u0131, kaynak kod ar\u015fivleri veya di\u011fer destekleyici dosyalar\u0131 varsa, bunlar\u0131 \"Attach binaries by dropping them here or selecting them\" b\u00f6l\u00fcm\u00fcne s\u00fcr\u00fckleyip b\u0131rakarak y\u00fckleyin. Bu varl\u0131klar da s\u00fcr\u00fcmle ili\u015fkilendirilecek ve GitHub taraf\u0131ndan depolanacakt\u0131r.<\/li>\n
- \"Publish release\" d\u00fc\u011fmesine t\u0131klay\u0131n.<\/li>\n<\/ol>\n
Bu ad\u0131mlarla, se\u00e7ti\u011finiz etikete ba\u011fl\u0131, a\u00e7\u0131klamalara ve ek varl\u0131klara sahip g\u00fcvenli bir s\u00fcr\u00fcm yay\u0131nlam\u0131\u015f olursunuz. GitHub, y\u00fckl\u00fc varl\u0131klar\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc sa\u011flamak i\u00e7in genellikle SHA-256 gibi kriptografik karmalar\u0131 otomatik olarak \u00fcretir ve g\u00f6r\u00fcnt\u00fcler. Kullan\u0131c\u0131lar bu karmalar\u0131, indirdikleri dosyalar\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc do\u011frulamak i\u00e7in kullanabilir.<\/p>\n
Ad\u0131m 3: Otomatik S\u00fcr\u00fcmler \u0130\u00e7in GitHub Actions Kullan\u0131m\u0131<\/h3>\n
Daha b\u00fcy\u00fck projelerde veya d\u00fczenli s\u00fcr\u00fcm d\u00f6ng\u00fclerine sahipseniz, GitHub Actions kullanarak s\u00fcr\u00fcm olu\u015fturma s\u00fcrecini otomatikle\u015ftirebilirsiniz. Bu, hem tutarl\u0131l\u0131\u011f\u0131 art\u0131r\u0131r hem de insan hatas\u0131 olas\u0131l\u0131\u011f\u0131n\u0131 azalt\u0131r.<\/p>\n
\n # .github\/workflows\/release.yml dosyas\u0131 \u00f6rne\u011fi\n name: Otomatik S\u00fcr\u00fcm Olu\u015fturma\n\n on:\n push:\n tags:\n - 'v*.*.*' # v ile ba\u015flayan t\u00fcm etiketleri tetikle\n\n jobs:\n release:\n runs-on: ubuntu-latest\n steps:\n - name: Depoyu \u00c7ek\n uses: actions\/checkout@v4\n with:\n fetch-depth: 0 # T\u00fcm ge\u00e7mi\u015fi \u00e7ek (etiket imzalar\u0131n\u0131 do\u011frulamak i\u00e7in)\n\n - name: GPG Anahtar\u0131n\u0131 Yap\u0131land\u0131r\n if: github.event_name == 'push' && startsWith(github.ref, 'refs\/tags\/v')\n run: |\n echo \"${{ secrets.GPG_PRIVATE_KEY }}\" | gpg --batch --import\n echo \"::add-mask::${{ secrets.GPG_PASSWORD }}\"\n git config --global user.signingkey ${{ secrets.GPG_KEY_ID }}\n git config --global commit.gpgsign true\n git config --global tag.gpgsign true\n env:\n GPG_TTY: $(tty)\n\n - name: S\u00fcr\u00fcm Varl\u0131klar\u0131n\u0131 Olu\u015ftur\n run: |\n # Burada projenizin derleme ad\u0131mlar\u0131 yer al\u0131r.\n # \u00d6rne\u011fin, bir ZIP ar\u015fivi olu\u015fturma:\n zip -r my-app-v${{ github.ref_name }}.zip . -x \"*.git*\"\n\n - name: GitHub S\u00fcr\u00fcm\u00fc Olu\u015ftur\n uses: softprops\/action-gh-release@v1\n with:\n tag_name: ${{ github.ref }}\n name: S\u00fcr\u00fcm ${{ github.ref_name }}\n body: |\n Bu, otomatik olarak olu\u015fturulmu\u015f bir s\u00fcr\u00fcmd\u00fcr.\n De\u011fi\u015fiklikleri g\u00f6rmek i\u00e7in l\u00fctfen changelog'a bak\u0131n.\n draft: false\n prerelease: false\n files: |\n my-app-v${{ github.ref_name }}.zip\n env:\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n<\/pre>\n<\/code><\/p>\n
\n Uzman \u0130pucu:<\/strong> GPG anahtar\u0131n\u0131z\u0131 GitHub Secrets'ta g\u00fcvenli bir \u015fekilde saklay\u0131n ve bu anahtar\u0131 sadece s\u00fcr\u00fcm olu\u015fturma i\u015f ak\u0131\u015flar\u0131n\u0131zda kullan\u0131n. Bu, anahtar\u0131n\u0131z\u0131n g\u00fcvenli\u011fini art\u0131r\u0131r. GPG_PRIVATE_KEY, GPG_KEY_ID ve GPG_PASSWORD'u kendi s\u0131rlar\u0131n\u0131zla de\u011fi\u015ftirin.\n<\/div>\nBu \u00f6rnek i\u015f ak\u0131\u015f\u0131, v*.*.*<\/code> desenine uyan bir etiket g\u00f6nderildi\u011finde tetiklenir. Projenizin varl\u0131klar\u0131n\u0131 olu\u015fturur ve softprops\/action-gh-release<\/code> eylemini kullanarak bir GitHub s\u00fcr\u00fcm\u00fc yay\u0131nlar. GITHUB_TOKEN<\/code>, GitHub Actions'\u0131n depolar\u0131n\u0131zda i\u015flem yapmas\u0131na izin veren otomatik olarak olu\u015fturulmu\u015f bir s\u0131rr\u0131d\u0131r. Bu otomasyon, g\u00fcvenlik ad\u0131mlar\u0131n\u0131 istikrarl\u0131 bir \u015fekilde uygulaman\u0131z\u0131 ve her s\u00fcr\u00fcm\u00fcn beklenen standartlar\u0131 kar\u015f\u0131lad\u0131\u011f\u0131ndan emin olman\u0131z\u0131 sa\u011flar.<\/p>\nTedarik Zinciri Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 De\u011fi\u015fmezli\u011fin Rol\u00fc<\/h2>\n
A\u00e7\u0131k kaynak tedarik zincirindeki g\u00fcvenlik a\u00e7\u0131klar\u0131, modern yaz\u0131l\u0131m geli\u015ftirmenin en b\u00fcy\u00fck zorluklar\u0131ndan biridir. Log4Shell gibi y\u00fcksek profilli olaylar, tek bir k\u00fct\u00fcphanedeki zafiyetin k\u00fcresel \u00e7apta ne kadar y\u0131k\u0131c\u0131 olabilece\u011fini g\u00f6sterdi. Tam da bu noktada, GitHub'daki de\u011fi\u015fmez (immutable) s\u00fcr\u00fcmler, bu t\u00fcr sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir savunma hatt\u0131 olu\u015fturur. De\u011fi\u015fmezlik, bir yaz\u0131l\u0131m bile\u015feninin belirli bir s\u00fcr\u00fcm\u00fcn\u00fcn, bir kez yay\u0131nland\u0131ktan sonra i\u00e7eri\u011finin de\u011fi\u015ftirilemeyece\u011fi anlam\u0131na gelir. Bu \u00f6zellik, tedarik zinciri sald\u0131rganlar\u0131n\u0131n hedeflerine ula\u015fmas\u0131n\u0131 zorla\u015ft\u0131ran birka\u00e7 \u00f6nemli mekanizma sunar.<\/p>\n
\u00d6ncelikle, de\u011fi\u015fmez s\u00fcr\u00fcmler, \"tampering\" olarak bilinen, yay\u0131nlanm\u0131\u015f bir paketin i\u00e7eri\u011finin k\u00f6t\u00fc niyetli bir \u015fekilde de\u011fi\u015ftirilmesi riskini ortadan kald\u0131r\u0131r. Bir sald\u0131rgan, \u00f6rne\u011fin bir projenin yay\u0131nlad\u0131\u011f\u0131 ikili dosyalardan birine k\u00f6t\u00fc ama\u00e7l\u0131 kod enjekte etmeye \u00e7al\u0131\u015fsa bile, GitHub'\u0131n s\u00fcr\u00fcm mekanizmas\u0131 bu de\u011fi\u015fikli\u011fe izin vermez. Her s\u00fcr\u00fcm, belirli bir Git etiketi ve o etiketle ili\u015fkilendirilmi\u015f dosyalarla s\u0131k\u0131ca ba\u011fl\u0131d\u0131r. Bu dosyalar\u0131n her birinin kendine \u00f6zg\u00fc bir kriptografik karmas\u0131 (hash) bulunur. E\u011fer bir dosyan\u0131n i\u00e7eri\u011fi de\u011fi\u015firse, karmas\u0131 da de\u011fi\u015fir. Dolay\u0131s\u0131yla, kullan\u0131c\u0131lar veya otomatik sistemler, indirdikleri dosyalar\u0131n karmas\u0131n\u0131 yay\u0131nlanan karmayla kar\u015f\u0131la\u015ft\u0131rarak herhangi bir tahrifat\u0131 an\u0131nda tespit edebilirler. Bu, yaz\u0131l\u0131m\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fcn do\u011frulanmas\u0131n\u0131 basit ve g\u00fcvenilir hale getirir.<\/p>\n
\u0130kinci olarak, de\u011fi\u015fmezlik, \"dependency confusion\" veya \"typosquatting\" gibi sald\u0131r\u0131lara kar\u015f\u0131 da dolayl\u0131 bir koruma sa\u011flar. Bu t\u00fcr sald\u0131r\u0131larda, sald\u0131rganlar pop\u00fcler bir pakete benzer isimlerle k\u00f6t\u00fc ama\u00e7l\u0131 paketler yay\u0131nlayarak geli\u015ftiricileri yan\u0131ltmaya \u00e7al\u0131\u015f\u0131r. Ancak, de\u011fi\u015fmez s\u00fcr\u00fcmler ve ili\u015fkili kriptografik imzalar, geli\u015ftiricilerin hangi paketin me\u015fru oldu\u011funu ve kimin taraf\u0131ndan yay\u0131nland\u0131\u011f\u0131n\u0131 do\u011frulamalar\u0131na yard\u0131mc\u0131 olur. GPG imzal\u0131 Git etiketleri ve GitHub taraf\u0131ndan sa\u011flanan dosya karmalar\u0131, bir s\u00fcr\u00fcm\u00fcn ger\u00e7ekten projenin orijinal geli\u015ftiricisi taraf\u0131ndan yay\u0131nland\u0131\u011f\u0131n\u0131 kan\u0131tlar. Bu sayede, yanl\u0131\u015fl\u0131kla k\u00f6t\u00fc ama\u00e7l\u0131 bir paketi indirme riski \u00f6nemli \u00f6l\u00e7\u00fcde azal\u0131r.<\/p>\n
Son olarak, de\u011fi\u015fmez s\u00fcr\u00fcmler, \"supply chain poisoning\" olarak adland\u0131r\u0131lan daha karma\u015f\u0131k sald\u0131r\u0131lara kar\u015f\u0131 da bir bariyer olu\u015fturur. Bu sald\u0131r\u0131lar, a\u00e7\u0131k kaynak projenin geli\u015ftirme s\u00fcrecine s\u0131zarak, k\u00f6t\u00fc niyetli kodu projenin kendi s\u00fcr\u00fcm\u00fcne dahil etmeyi ama\u00e7lar. De\u011fi\u015fmez s\u00fcr\u00fcmler, bu t\u00fcr bir s\u0131zman\u0131n ger\u00e7ekle\u015fmesi durumunda bile, en az\u0131ndan bir s\u00fcr\u00fcm yay\u0131nland\u0131ktan sonra i\u00e7eri\u011finin daha fazla de\u011fi\u015ftirilemeyece\u011fi anlam\u0131na gelir. E\u011fer k\u00f6t\u00fc niyetli kod bir s\u00fcr\u00fcme dahil edilmi\u015fse, bu durum bir sonraki ad\u0131mda (\u00f6rne\u011fin, g\u00fcvenlik taramalar\u0131 veya kod incelemeleri s\u0131ras\u0131nda) tespit edildi\u011finde, o s\u00fcr\u00fcm\u00fcn \"bozulmu\u015f\" oldu\u011fu kabul edilebilir ve bir sonraki s\u00fcr\u00fcmde d\u00fczeltilebilir. Ancak, eski, tahrif edilmi\u015f s\u00fcr\u00fcm\u00fcn kendisi \u00fczerinde de\u011fi\u015fiklik yapmak yerine, yeni ve temiz bir s\u00fcr\u00fcm yay\u0131nlanmas\u0131 gereklili\u011fi, izlenebilirli\u011fi art\u0131r\u0131r ve k\u00f6t\u00fcye kullan\u0131m\u0131 zorla\u015ft\u0131r\u0131r. Bu yakla\u015f\u0131m, yaz\u0131l\u0131m\u0131n g\u00fcvenli\u011fini sa\u011flamak ve olas\u0131 tehditlere kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir duru\u015f sergilemek i\u00e7in hayati bir ara\u00e7t\u0131r.<\/p>\n
Vaka Analizi: De\u011fi\u015fmez S\u00fcr\u00fcmlerin Ger\u00e7ek D\u00fcnya Etkileri<\/h2>\n
De\u011fi\u015fmez s\u00fcr\u00fcmlerin teorik faydalar\u0131 a\u00e7\u0131k olsa da, bunlar\u0131n ger\u00e7ek d\u00fcnyadaki projeler ve tedarik zinciri g\u00fcvenli\u011fi \u00fczerindeki etkilerini anlamak daha \u00f6nemlidir. \u0130\u015fte birka\u00e7 senaryo \u00fczerinden bu kavram\u0131n pratik uygulamalar\u0131:<\/p>\n
Senaryo 1: Zararl\u0131 Yaz\u0131l\u0131m Enjeksiyonu Giri\u015fimi<\/h3>\n
B\u00fcy\u00fck bir a\u00e7\u0131k kaynak web \u00e7er\u00e7evesi olan \"FrameworkX\", milyonlarca web sitesi taraf\u0131ndan kullan\u0131lmaktad\u0131r. Bir sald\u0131rgan, FrameworkX'in GitHub deposuna eri\u015fim sa\u011flamay\u0131 ba\u015far\u0131r. Ama\u00e7lar\u0131, en son yay\u0131nlanan \"v2.5.0\" s\u00fcr\u00fcm\u00fcndeki bir ikili dosyaya (frameworkx.jar<\/code>) k\u00f6t\u00fc ama\u00e7l\u0131 bir arka kap\u0131 (backdoor) enjekte etmektir. Sald\u0131rgan, bu dosyay\u0131 de\u011fi\u015ftirir ve kendi k\u00f6t\u00fc niyetli s\u00fcr\u00fcm\u00fcn\u00fc y\u00fcklemeye \u00e7al\u0131\u015f\u0131r.<\/p>\nDe\u011fi\u015fmez S\u00fcr\u00fcmler Olmasayd\u0131:<\/strong> Sald\u0131rgan, muhtemelen dosyay\u0131 GitHub'daki s\u00fcr\u00fcm varl\u0131klar\u0131 aras\u0131nda de\u011fi\u015ftirebilirdi. Bu, FrameworkX'i kullanan t\u00fcm ba\u011f\u0131ml\u0131 projelerin, fark\u0131nda olmadan k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131ml\u0131 s\u00fcr\u00fcm\u00fc indirmesine neden olurdu. Binlerce uygulama an\u0131nda riske girerdi ve bu sald\u0131r\u0131n\u0131n tespiti, k\u00f6t\u00fc niyetli kod aktif hale gelene kadar olduk\u00e7a zor olabilirdi.<\/p>\nDe\u011fi\u015fmez S\u00fcr\u00fcmler Sayesinde:<\/strong> GitHub'\u0131n de\u011fi\u015fmez s\u00fcr\u00fcm mekanizmalar\u0131 devreye girer. Sald\u0131rgan, frameworkx.jar<\/code> dosyas\u0131n\u0131 de\u011fi\u015ftirmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131nda, sistem buna izin vermez. Mevcut v2.5.0<\/code> s\u00fcr\u00fcm\u00fcndeki dosyan\u0131n karmas\u0131 sabittir ve bu dosyan\u0131n i\u00e7eri\u011fi de\u011fi\u015ftirilemez. E\u011fer sald\u0131rgan yeni bir dosya y\u00fcklemeye kalkarsa, bu dosyan\u0131n karmas\u0131 orijinaliyle e\u015fle\u015fmez. Hatta GitHub, bir kez yay\u0131nlanm\u0131\u015f bir s\u00fcr\u00fcm\u00fcn varl\u0131klar\u0131n\u0131n do\u011frudan g\u00fcncellenmesine genellikle izin vermez; bu t\u00fcr de\u011fi\u015fiklikler i\u00e7in yeni bir s\u00fcr\u00fcm veya yama s\u00fcr\u00fcm\u00fc (hotfix) yay\u0131nlanmas\u0131 gerekir. Bu durum, sald\u0131rgan\u0131n amac\u0131na ula\u015fmas\u0131n\u0131 engeller. Ba\u011f\u0131ml\u0131 projeler ve kullan\u0131c\u0131lar, frameworkx.jar<\/code>'\u0131n SHA-256 karmas\u0131n\u0131 kontrol etti\u011finde, bunun orijinal ve beklenen de\u011ferle e\u015fle\u015fti\u011fini g\u00f6r\u00fcr ve g\u00fcvenle kullanmaya devam ederler.<\/p>\n\n Uzman \u0130pucu:<\/strong> Ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131z\u0131 projenize entegre ederken, indirilen her paketin veya ikili dosyan\u0131n yay\u0131nc\u0131n\u0131n sa\u011flad\u0131\u011f\u0131 karma (checksum) ile e\u015fle\u015fti\u011fini mutlaka do\u011frulay\u0131n. Bu, otomatik CI\/CD s\u00fcre\u00e7lerinizin \u00f6nemli bir par\u00e7as\u0131 olmal\u0131d\u0131r.\n<\/div>\nSenaryo 2: Yanl\u0131\u015fl\u0131kla De\u011fi\u015fiklik veya Verilerin Bozulmas\u0131<\/h3>\n
Bir geli\u015ftirici, \"UtilityLib\" adl\u0131 k\u00fc\u00e7\u00fck bir a\u00e7\u0131k kaynak k\u00fct\u00fcphanesi \u00fczerinde \u00e7al\u0131\u015fmaktad\u0131r. K\u00fct\u00fcphanenin \"v1.1.0\" s\u00fcr\u00fcm\u00fcn\u00fc yay\u0131nlar. Birka\u00e7 hafta sonra, testler s\u0131ras\u0131nda baz\u0131 k\u00fc\u00e7\u00fck hatalar bulur ve bu hatalar\u0131 h\u0131zla d\u00fczeltmek i\u00e7in v1.1.0<\/code> s\u00fcr\u00fcm\u00fcn\u00fcn ikili dosyalar\u0131n\u0131 do\u011frudan GitHub \u00fczerinden g\u00fcncellemeyi d\u00fc\u015f\u00fcn\u00fcr.<\/p>\nDe\u011fi\u015fmez S\u00fcr\u00fcmler Olmasayd\u0131:<\/strong> Geli\u015ftirici, eski ikili dosyalar\u0131 silebilir ve yerine yeni, d\u00fczeltilmi\u015f dosyalar\u0131 y\u00fckleyebilirdi. Ancak bu, v1.1.0<\/code> s\u00fcr\u00fcm\u00fcn\u00fc indiren herkesin farkl\u0131 bir i\u00e7eri\u011fe sahip olaca\u011f\u0131 anlam\u0131na gelirdi. Bu durum, s\u00fcr\u00fcm tutars\u0131zl\u0131klar\u0131na, hata ay\u0131klama zorluklar\u0131na ve hatta g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n fark edilmeden kalmas\u0131na yol a\u00e7abilirdi. S\u00fcr\u00fcm takip edilebilirli\u011fi b\u00fcy\u00fck \u00f6l\u00e7\u00fcde zarar g\u00f6r\u00fcrd\u00fc.<\/p>\nDe\u011fi\u015fmez S\u00fcr\u00fcmler Sayesinde:<\/strong> GitHub'\u0131n de\u011fi\u015fmezlik ilkesi, geli\u015ftiricinin v1.1.0<\/code> s\u00fcr\u00fcm\u00fcndeki dosyalar\u0131 do\u011frudan de\u011fi\u015ftirmesini engeller. Geli\u015ftiriciye, hatalar\u0131 d\u00fczeltmek i\u00e7in yeni bir yama s\u00fcr\u00fcm\u00fc (\u00f6rne\u011fin, v1.1.1<\/code>) olu\u015fturmas\u0131 gerekti\u011fi mesaj\u0131 verilir. Bu, hem projenin s\u00fcr\u00fcm ge\u00e7mi\u015finin temiz kalmas\u0131n\u0131 sa\u011flar hem de v1.1.0<\/code> s\u00fcr\u00fcm\u00fcn\u00fc kullanan herkesin tam olarak ayn\u0131, ilk yay\u0131nlanan kod taban\u0131na sahip olmas\u0131n\u0131 garanti eder. E\u011fer v1.1.0<\/code> s\u00fcr\u00fcm\u00fcnde kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 bulunursa, bu s\u00fcr\u00fcm\u00fcn de\u011fi\u015ftirilemez olmas\u0131, a\u00e7\u0131\u011f\u0131n d\u00fczeltilmemi\u015f halinin istem d\u0131\u015f\u0131 kullan\u0131m\u0131n\u0131n devam etmesini engellemez, ancak a\u00e7\u0131\u011f\u0131n bulundu\u011fu s\u00fcr\u00fcm\u00fcn tam olarak ne oldu\u011funu ve ne zaman d\u00fczeltildi\u011fini net bir \u015fekilde belirlemeyi kolayla\u015ft\u0131r\u0131r. Yeni bir s\u00fcr\u00fcm, bu a\u00e7\u0131\u011f\u0131n kapat\u0131ld\u0131\u011f\u0131n\u0131 a\u00e7\u0131k\u00e7a belirtir ve kullan\u0131c\u0131lar g\u00fcvenli s\u00fcr\u00fcme ge\u00e7i\u015f yapabilirler. Bu durum, yaz\u0131l\u0131m tedarik zincirinde \u015feffafl\u0131k ve g\u00fcvenilirlik sa\u011flar.<\/p>\nBu senaryolar, de\u011fi\u015fmez s\u00fcr\u00fcmlerin sadece k\u00f6t\u00fc niyetli sald\u0131r\u0131lar\u0131 de\u011fil, ayn\u0131 zamanda yanl\u0131\u015fl\u0131kla yap\u0131lan hatalar\u0131 ve s\u00fcr\u00fcm y\u00f6netimi tutars\u0131zl\u0131klar\u0131n\u0131 da nas\u0131l \u00f6nleyebilece\u011fini g\u00f6stermektedir. Bu \u00f6zellik, a\u00e7\u0131k kaynak ekosisteminin genel g\u00fcvenli\u011fini ve istikrar\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r.<\/p>\n
\u0130leri D\u00fczey G\u00fcvenlik \u0130pu\u00e7lar\u0131 ve Otomasyon<\/h2>\n
De\u011fi\u015fmez GitHub s\u00fcr\u00fcmlerini kullanmak, temel bir g\u00fcvenlik ad\u0131m\u0131d\u0131r. Ancak tedarik zinciri g\u00fcvenli\u011fini daha da ileri ta\u015f\u0131mak i\u00e7in entegre otomasyon ve ek g\u00fcvenlik katmanlar\u0131 eklemek hayati \u00f6nem ta\u015f\u0131r. \u0130\u015fte deneyimli geli\u015ftiriciler ve g\u00fcvenlik m\u00fchendisleri i\u00e7in baz\u0131 ileri d\u00fczey ipu\u00e7lar\u0131:<\/p>\n
CI\/CD S\u00fcrecinde Otomatik G\u00fcvenlik Taramalar\u0131 Nas\u0131l Entegre Edilir?<\/h3>\n
Sadece de\u011fi\u015fmez s\u00fcr\u00fcm olu\u015fturmak yetmez; o s\u00fcr\u00fcm\u00fcn i\u00e7eri\u011finin de g\u00fcvenli oldu\u011fundan emin olmak gerekir. GitHub Actions gibi CI\/CD ara\u00e7lar\u0131n\u0131 kullanarak, her s\u00fcr\u00fcm \u00f6ncesinde veya etiket g\u00f6nderiminde otomatik g\u00fcvenlik taramalar\u0131 yapabilirsiniz.<\/p>\n
\n- Ba\u011f\u0131ml\u0131l\u0131k Taramas\u0131 (Dependency Scanning):<\/strong> Kullan\u0131lan t\u00fcm \u00fc\u00e7\u00fcnc\u00fc taraf k\u00fct\u00fcphanelerdeki bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek i\u00e7in Snyk, Dependabot (yerle\u015fik GitHub \u00f6zelli\u011fi) veya OWASP Dependency-Check gibi ara\u00e7lar\u0131 entegre edin. Bu, tedarik zincirinizin d\u0131\u015f ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 izlemenize yard\u0131mc\u0131 olur.<\/li>\n
- Statik Uygulama G\u00fcvenlik Testi (SAST):<\/strong> Kodunuzdaki potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 (\u00f6rne\u011fin, SQL enjeksiyonu, XSS) derleme \u00f6ncesinde tespit etmek i\u00e7in CodeQL (GitHub'\u0131n kendi arac\u0131), SonarQube veya Bandit gibi SAST ara\u00e7lar\u0131n\u0131 kullan\u0131n.<\/li>\n
- Tedarik Zinciri G\u00fcvenli\u011fi Platformlar\u0131:<\/strong> Sigstore gibi platformlar, yaz\u0131l\u0131m varl\u0131klar\u0131n\u0131z\u0131 (\u00f6zellikle konteyner g\u00f6r\u00fcnt\u00fclerini) imzalaman\u0131za ve bu imzalar\u0131n bir kamu defterinde (rekor) kaydedilmesini sa\u011flar. Bu, t\u00fcketici taraf\u0131ndan do\u011frulamay\u0131 kolayla\u015ft\u0131r\u0131r ve tedarik zinciri \u015feffafl\u0131\u011f\u0131n\u0131 art\u0131r\u0131r.<\/li>\n<\/ul>\n
\n # .github\/workflows\/security-scan.yml\n name: G\u00fcvenlik Taramalar\u0131\n\n on:\n push:\n branches: [ main ]\n pull_request:\n branches: [ main ]\n\n jobs:\n security:\n runs-on: ubuntu-latest\n steps:\n - uses: actions\/checkout@v4\n - name: CodeQL \u0130ncelemesi Ba\u015flat\n uses: github\/codeql-action\/init@v3\n with:\n languages: javascript # Projenizin dilini buraya yaz\u0131n\n - name: CodeQL Otomatik Olu\u015ftur\n uses: github\/codeql-action\/autobuild@v3\n - name: CodeQL Sonu\u00e7lar\u0131 Y\u00fckle\n uses: github\/codeql-action\/analyze@v3\n\n - name: Snyk Ba\u011f\u0131ml\u0131l\u0131k Taramas\u0131\n uses: snyk\/actions\/node@master\n env:\n SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n with:\n command: test\n<\/pre>\n<\/code><\/p>\n
SBOM (Yaz\u0131l\u0131m Malzeme Listesi) Olu\u015fturma ve S\u00fcr\u00fcmlere Ekleme<\/h3>\n
SBOM (Software Bill of Materials), yaz\u0131l\u0131m\u0131n\u0131z\u0131n i\u00e7inde bulunan t\u00fcm bile\u015fenlerin (k\u00fct\u00fcphaneler, mod\u00fcller, kaynaklar) bir listesidir. Bu, tedarik zinciri \u015feffafl\u0131\u011f\u0131 ve g\u00fcvenlik a\u00e7\u0131\u011f\u0131 y\u00f6netiminde kritik \u00f6neme sahiptir. Her GitHub s\u00fcr\u00fcm\u00fcne bir SBOM eklemek, o s\u00fcr\u00fcm\u00fc t\u00fcketenlerin i\u00e7eri\u011fi hakk\u0131nda tam bilgi sahibi olmas\u0131n\u0131 sa\u011flar.<\/p>\n
SBOM'leri genellikle CycloneDX veya SPDX formatlar\u0131nda olu\u015fturabilirsiniz. Bunlar\u0131 otomatik olarak olu\u015fturmak i\u00e7in ba\u011f\u0131ml\u0131l\u0131k y\u00f6neticileriyle (\u00f6rne\u011fin, Maven, npm, pip) entegre \u00e7al\u0131\u015fan ara\u00e7lar mevcuttur. Daha sonra bu SBOM dosyas\u0131n\u0131, GitHub Actions kullanarak s\u00fcr\u00fcm varl\u0131klar\u0131 aras\u0131na ekleyebilirsiniz.<\/p>\n
\n # .github\/workflows\/generate-sbom.yml\n name: SBOM Olu\u015ftur ve S\u00fcr\u00fcme Ekle\n\n on:\n release:\n types: [ published ] # S\u00fcr\u00fcm yay\u0131nland\u0131\u011f\u0131nda tetikle\n\n jobs:\n generate-sbom:\n runs-on: ubuntu-latest\n steps:\n - uses: actions\/checkout@v4\n - name: Node.js Kur (\u00d6rnek)\n uses: actions\/setup-node@v4\n with:\n node-version: '18'\n - name: Ba\u011f\u0131ml\u0131l\u0131klar\u0131 Y\u00fckle\n run: npm install\n - name: SBOM Olu\u015ftur (cyclonedx-npm \u00f6rnek)\n run: npx cyclonedx-npm@latest --output-file bom.json\n - name: S\u00fcr\u00fcm Varl\u0131\u011f\u0131na Ekle\n uses: actions\/upload-release-asset@v1\n env:\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n with:\n upload_url: ${{ github.event.release.upload_url }}\n asset_path: .\/bom.json\n asset_name: bom-${{ github.event.release.tag_name }}.json\n asset_content_type: application\/json\n<\/pre>\n<\/code><\/p>\n
Bu i\u015f ak\u0131\u015f\u0131, her yeni s\u00fcr\u00fcm yay\u0131nland\u0131\u011f\u0131nda otomatik olarak bir SBOM olu\u015fturur ve bunu ilgili GitHub s\u00fcr\u00fcm\u00fcne bir varl\u0131k olarak ekler. T\u00fcketiciler, bu SBOM dosyas\u0131n\u0131 indirerek, yaz\u0131l\u0131m\u0131n i\u00e7inde ne t\u00fcr bile\u015fenler oldu\u011funu, lisans bilgilerini ve bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kolayca kontrol edebilir.<\/p>\n
Mobil Uyumlu HTML Belgelendirme Neden \u00d6nemli?<\/h3>\n
G\u00fcvenlik s\u00fcre\u00e7leri ve belgeleri genellikle geli\u015ftiriciler taraf\u0131ndan masa\u00fcst\u00fc bilgisayarlarda incelenir. Ancak, a\u00e7\u0131k kaynak projelerin belgelerinin ve g\u00fcvenlik rehberlerinin mobil cihazlarda da kolayca okunabilir olmas\u0131, ula\u015f\u0131labilirli\u011fi ve dolay\u0131s\u0131yla g\u00fcvenli\u011fi art\u0131r\u0131r. Mobil cihazlar \u00fczerinden h\u0131zl\u0131ca bir sorun giderme veya g\u00fcvenlik kontrol\u00fc yapma ihtiyac\u0131 do\u011fdu\u011funda, responsive (duyarl\u0131) tasar\u0131ma sahip web sayfalar\u0131 kritik \u00f6nem ta\u015f\u0131r. Bu, geli\u015ftiricilerin g\u00fcvenlik bilgilerine her yerden ve her zaman eri\u015febilmesini sa\u011flar. HTML yap\u0131n\u0131z\u0131 mobil uyumlu hale getirmek i\u00e7in CSS media query'ler kullanabilirsiniz. \u0130\u015fte basit bir \u00f6rnek:<\/p>\n
\n \/* Genel stiller *\/\n body {\n font-family: Arial, sans-serif;\n line-height: 1.6;\n margin: 0;\n padding: 20px;\n }\n\n \/* Mobil cihazlar i\u00e7in \u00f6zel stiller *\/\n @media (max-width: 768px) {\n body {\n padding: 10px;\n }\n h2 {\n font-size: 1.5em;\n }\n p {\n font-size: 0.9em;\n }\n \/* Tablolar\u0131n mobil uyumlu hale getirilmesi *\/\n table, thead, tbody, th, td, tr {\n display: block;\n }\n thead tr {\n position: absolute;\n top: -9999px;\n left: -9999px;\n }\n tr { border: 1px solid #ccc; }\n td {\n border: none;\n border-bottom: 1px solid #eee;\n position: relative;\n padding-left: 50%;\n }\n td:before {\n position: absolute;\n top: 6px;\n left: 6px;\n width: 45%;\n padding-right: 10px;\n white-space: nowrap;\n content: attr(data-label); \/* Her td'ye data-label ekleyin *\/\n font-weight: bold;\n }\n }\n<\/pre>\n<\/code><\/p>\n
Yukar\u0131daki CSS \u00f6rne\u011fi, ekran geni\u015fli\u011fi 768 pikselden az oldu\u011funda uygulanan stil de\u011fi\u015fikliklerini g\u00f6stermektedir. Bu t\u00fcr bir yakla\u015f\u0131m, GitHub'da bar\u0131nd\u0131r\u0131lan statik site jenerat\u00f6rleri (Jekyll, Hugo) veya do\u011frudan HTML dosyalar\u0131 arac\u0131l\u0131\u011f\u0131yla sa\u011flanan g\u00fcvenlik belgelerinin mobil cihazlarda da okunabilir ve kullan\u0131labilir olmas\u0131n\u0131 sa\u011flar. G\u00fcvenlik bilgisinin ula\u015f\u0131labilirli\u011fi, genel g\u00fcvenlik duru\u015funun \u00f6nemli bir par\u00e7as\u0131d\u0131r.<\/p>\n
Sonu\u00e7: G\u00fcvenli Bir Gelecek \u0130\u00e7in De\u011fi\u015fmez S\u00fcr\u00fcmler<\/h2>\n
A\u00e7\u0131k kaynak yaz\u0131l\u0131m ekosistemi, modern yaz\u0131l\u0131m geli\u015ftirmenin itici g\u00fcc\u00fcd\u00fcr ve inovasyonu h\u0131zland\u0131r\u0131r. Ancak, bu ekosistemin g\u00fcvenli\u011fi, her zamankinden daha fazla \u00f6nem ta\u015f\u0131yor. Tedarik zinciri sald\u0131r\u0131lar\u0131 giderek karma\u015f\u0131k hale gelirken, GitHub'\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak projelerin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve g\u00fcvenilirli\u011fini sa\u011flama konusunda vazge\u00e7ilmez bir ara\u00e7 olarak \u00f6ne \u00e7\u0131kmaktad\u0131r. Bu makalede ele ald\u0131\u011f\u0131m\u0131z gibi, de\u011fi\u015fmez s\u00fcr\u00fcmler, bir yaz\u0131l\u0131m par\u00e7as\u0131n\u0131n bir kez yay\u0131nland\u0131ktan sonra de\u011fi\u015ftirilemeyece\u011fini garanti ederek, k\u00f6t\u00fc niyetli m\u00fcdahalelere ve yanl\u0131\u015fl\u0131kla yap\u0131lan de\u011fi\u015fikliklere kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir savunma hatt\u0131 olu\u015fturur.<\/p>\n
Git etiketlerinin GPG ile imzalanmas\u0131, s\u00fcr\u00fcm varl\u0131klar\u0131n\u0131n kriptografik karmalar\u0131n\u0131n otomatik olarak \u00fcretilmesi ve GitHub Actions ile entegre g\u00fcvenlik otomasyonlar\u0131, bu de\u011fi\u015fmezlik ilkesini daha da peki\u015ftirmektedir. Ger\u00e7ek d\u00fcnya senaryolar\u0131, bu \u00f6zelliklerin bir sald\u0131rgan\u0131n zararl\u0131 yaz\u0131l\u0131m enjekte etme giri\u015fimini veya bir geli\u015ftiricinin yanl\u0131\u015fl\u0131kla s\u00fcr\u00fcm dosyalar\u0131n\u0131 bozmas\u0131n\u0131 nas\u0131l engelleyebilece\u011fini net bir \u015fekilde g\u00f6stermektedir. Ayr\u0131ca, SBOM'lerin s\u00fcr\u00fcm varl\u0131klar\u0131na eklenmesi ve kapsaml\u0131 CI\/CD entegrasyonlar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini bir sonraki seviyeye ta\u015f\u0131yan proaktif ad\u0131mlard\u0131r.<\/p>\n
Geli\u015ftiricilerin ve organizasyonlar\u0131n, a\u00e7\u0131k kaynak ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 kullan\u0131rken bu g\u00fcvenlik pratiklerini benimsemeleri, sadece kendi projelerini de\u011fil, t\u00fcm yaz\u0131l\u0131m ekosistemini daha diren\u00e7li hale getirecektir. Unutmay\u0131n ki g\u00fcvenlik, bir \u00f6zellik de\u011fil, bir s\u00fcre\u00e7tir ve s\u00fcrekli dikkat ile iyile\u015ftirme gerektirir. GitHub'\u0131n sa\u011flad\u0131\u011f\u0131 bu g\u00fc\u00e7l\u00fc ara\u00e7larla, a\u00e7\u0131k kaynak d\u00fcnyas\u0131nda daha g\u00fcvenli ve \u015feffaf bir gelecek in\u015fa edebiliriz. Art\u0131k harekete ge\u00e7me ve projelerinizi bu ileri d\u00fczey g\u00fcvenlik \u00f6nlemleriyle g\u00fc\u00e7lendirme zaman\u0131 geldi.<\/p>\n
S\u0131k\u00e7a Sorulan Sorular<\/h2>\n1. De\u011fi\u015fmez s\u00fcr\u00fcmler yay\u0131nland\u0131ktan sonra bir hatay\u0131 nas\u0131l d\u00fczeltirim?<\/h3>\n
Yay\u0131nlanm\u0131\u015f bir s\u00fcr\u00fcm\u00fcn i\u00e7eri\u011fi de\u011fi\u015ftirilemez. E\u011fer bir hata bulursan\u0131z veya bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 kapatman\u0131z gerekirse, yeni bir etiketle (\u00f6rne\u011fin, v1.0.1<\/code>) yeni bir yama s\u00fcr\u00fcm\u00fc (hotfix release) olu\u015fturman\u0131z gerekir. Bu, s\u00fcr\u00fcm ge\u00e7mi\u015finizin temiz kalmas\u0131n\u0131 ve kullan\u0131c\u0131lar\u0131n hangi s\u00fcr\u00fcm\u00fcn d\u00fczeltilmi\u015f oldu\u011funu net bir \u015fekilde bilmesini sa\u011flar.<\/p>\n2. T\u00fcm a\u00e7\u0131k kaynak projeleri de\u011fi\u015fmez s\u00fcr\u00fcmler kullanmal\u0131 m\u0131d\u0131r?<\/h3>\n
Evet, \u00f6zellikle son kullan\u0131c\u0131lar taraf\u0131ndan t\u00fcketilen veya di\u011fer projelere ba\u011f\u0131ml\u0131l\u0131k olarak eklenen t\u00fcm a\u00e7\u0131k kaynak projelerin de\u011fi\u015fmez s\u00fcr\u00fcmler kullanmas\u0131 \u015fiddetle tavsiye edilir. Bu, tedarik zinciri sald\u0131r\u0131lar\u0131na kar\u015f\u0131 temel bir koruma katman\u0131 sa\u011flar ve yaz\u0131l\u0131m\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc garanti eder.<\/p>\n
3. De\u011fi\u015fmez s\u00fcr\u00fcmler sadece GitHub i\u00e7in mi ge\u00e7erli?<\/h3>\n
Hay\u0131r, de\u011fi\u015fmezlik ilkesi (immutability) genel bir g\u00fcvenlik konseptidir ve di\u011fer s\u00fcr\u00fcm kontrol sistemleri veya yaz\u0131l\u0131m da\u011f\u0131t\u0131m platformlar\u0131nda da uygulanabilir. GitHub, bu ilkeyi kendi s\u00fcr\u00fcm mekanizmalar\u0131 arac\u0131l\u0131\u011f\u0131yla g\u00fc\u00e7l\u00fc bir \u015fekilde destekler ve entegre ara\u00e7larla kolayla\u015ft\u0131r\u0131r.<\/p>\n
4. De\u011fi\u015fmez s\u00fcr\u00fcmler g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tamamen \u00f6nler mi?<\/h3>\n
De\u011fi\u015fmez s\u00fcr\u00fcmler, yaz\u0131l\u0131m\u0131n i\u00e7eri\u011finin yay\u0131nland\u0131ktan sonra tahrif edilmesini \u00f6nler ve kimlik do\u011frulamas\u0131n\u0131 sa\u011flar. Ancak, yaz\u0131l\u0131m\u0131n kendi i\u00e7indeki kodda bulunan g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 (\u00f6rne\u011fin, yanl\u0131\u015fl\u0131kla yaz\u0131lm\u0131\u015f bir kod hatas\u0131 veya mant\u0131k hatas\u0131) do\u011frudan engellemez. Bu t\u00fcr a\u00e7\u0131klar i\u00e7in statik analiz, dinamik analiz ve d\u00fczenli kod incelemeleri gibi ek g\u00fcvenlik \u00f6nlemleri gereklidir.<\/p>\n
\n\n\n\u00d6zellik<\/th>\n A\u00e7\u0131klama<\/th>\n Faydas\u0131<\/th>\n<\/tr>\n<\/thead>\n \n\nGPG \u0130mzal\u0131 Etiketler<\/strong><\/td>\nS\u00fcr\u00fcm etiketlerinin geli\u015ftiricinin \u00f6zel anahtar\u0131yla imzalanmas\u0131.<\/td>\n S\u00fcr\u00fcm\u00fcn ger\u00e7ek geli\u015ftirici taraf\u0131ndan yay\u0131nland\u0131\u011f\u0131n\u0131 do\u011frular, kimlik sahtekarl\u0131\u011f\u0131n\u0131 \u00f6nler.<\/td>\n<\/tr>\n \nKriptografik Karmalar (Hash)<\/strong><\/td>\nYay\u0131nlanan varl\u0131klar\u0131n (ikili dosyalar, ar\u015fivler) benzersiz dijital parmak izleri.<\/td>\n \u0130ndirilen dosyan\u0131n yay\u0131nlanan dosyayla ayn\u0131 oldu\u011funu ve \u00fczerinde de\u011fi\u015fiklik yap\u0131lmad\u0131\u011f\u0131n\u0131 kan\u0131tlar.<\/td>\n<\/tr>\n \nDe\u011fi\u015fmez Varl\u0131klar<\/strong><\/td>\nBir kez GitHub'a y\u00fcklenen s\u00fcr\u00fcm varl\u0131klar\u0131n\u0131n de\u011fi\u015ftirilememesi.<\/td>\n Yay\u0131nland\u0131ktan sonra k\u00f6t\u00fc niyetli veya yanl\u0131\u015fl\u0131kla i\u00e7eri\u011fin de\u011fi\u015ftirilmesini engeller.<\/td>\n<\/tr>\n \nOtomatik CI\/CD Entegrasyonu<\/strong><\/td>\nGitHub Actions ile s\u00fcr\u00fcm olu\u015fturma ve g\u00fcvenlik taramalar\u0131n\u0131n otomatikle\u015ftirilmesi.<\/td>\n G\u00fcvenlik ad\u0131mlar\u0131n\u0131n tutarl\u0131 ve hatas\u0131z bir \u015fekilde uygulanmas\u0131n\u0131 sa\u011flar, geli\u015ftirici y\u00fck\u00fcn\u00fc azalt\u0131r.<\/td>\n<\/tr>\n \nSBOM Ekleme<\/strong><\/td>\nS\u00fcr\u00fcmlere yaz\u0131l\u0131m bile\u015fenleri listesi (Software Bill of Materials) eklenmesi.<\/td>\n Tedarik zinciri \u015feffafl\u0131\u011f\u0131n\u0131 art\u0131r\u0131r, kullan\u0131c\u0131lar\u0131n ba\u011f\u0131ml\u0131l\u0131klar\u0131 ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 daha iyi anlamas\u0131n\u0131 sa\u011flar.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik…","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1401],"tags":[],"class_list":{"0":"post-33941","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-git","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nGitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi<\/title>\n<meta name=\"description\" content=\"A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik risklerini de getiriyor. Peki, kulland\u0131\u011f\u0131n\u0131z a\u00e7\u0131k kaynak bile\u015fenlerinin ger\u00e7ekten g\u00fcvende oldu\u011fundan ve \u00fczerinde oynanmad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? GitHub'\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini sa\u011flamada kritik bir rol oynar. Bu makalede, GitHub'\u0131n bu g\u00fc\u00e7l\u00fc \u00f6zelli\u011finin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden bu kadar \u00f6nemli oldu\u011funu ve projelerinizi siber sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilece\u011finizi ad\u0131m ad\u0131m ke\u015ffedece\u011fiz. Ba\u015flamak i\u00e7in haz\u0131r m\u0131s\u0131n\u0131z?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi\" \/>\n<meta property=\"og:description\" content=\"A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik risklerini de getiriyor. Peki, kulland\u0131\u011f\u0131n\u0131z a\u00e7\u0131k kaynak bile\u015fenlerinin ger\u00e7ekten g\u00fcvende oldu\u011fundan ve \u00fczerinde oynanmad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? GitHub'\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini sa\u011flamada kritik bir rol oynar. Bu makalede, GitHub'\u0131n bu g\u00fc\u00e7l\u00fc \u00f6zelli\u011finin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden bu kadar \u00f6nemli oldu\u011funu ve projelerinizi siber sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilece\u011finizi ad\u0131m ad\u0131m ke\u015ffedece\u011fiz. Ba\u015flamak i\u00e7in haz\u0131r m\u0131s\u0131n\u0131z?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-09T01:30:57+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"27 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi\",\"datePublished\":\"2025-11-09T01:30:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/\"},\"wordCount\":4825,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Git\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/\",\"name\":\"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-09T01:30:57+00:00\",\"description\":\"A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik risklerini de getiriyor. Peki, kulland\u0131\u011f\u0131n\u0131z a\u00e7\u0131k kaynak bile\u015fenlerinin ger\u00e7ekten g\u00fcvende oldu\u011fundan ve \u00fczerinde oynanmad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? GitHub'\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini sa\u011flamada kritik bir rol oynar. Bu makalede, GitHub'\u0131n bu g\u00fc\u00e7l\u00fc \u00f6zelli\u011finin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden bu kadar \u00f6nemli oldu\u011funu ve projelerinizi siber sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilece\u011finizi ad\u0131m ad\u0131m ke\u015ffedece\u011fiz. Ba\u015flamak i\u00e7in haz\u0131r m\u0131s\u0131n\u0131z?\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi","description":"A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik risklerini de getiriyor. Peki, kulland\u0131\u011f\u0131n\u0131z a\u00e7\u0131k kaynak bile\u015fenlerinin ger\u00e7ekten g\u00fcvende oldu\u011fundan ve \u00fczerinde oynanmad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? GitHub'\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini sa\u011flamada kritik bir rol oynar. Bu makalede, GitHub'\u0131n bu g\u00fc\u00e7l\u00fc \u00f6zelli\u011finin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden bu kadar \u00f6nemli oldu\u011funu ve projelerinizi siber sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilece\u011finizi ad\u0131m ad\u0131m ke\u015ffedece\u011fiz. Ba\u015flamak i\u00e7in haz\u0131r m\u0131s\u0131n\u0131z?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/","og_locale":"tr_TR","og_type":"article","og_title":"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi","og_description":"A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik risklerini de getiriyor. Peki, kulland\u0131\u011f\u0131n\u0131z a\u00e7\u0131k kaynak bile\u015fenlerinin ger\u00e7ekten g\u00fcvende oldu\u011fundan ve \u00fczerinde oynanmad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? GitHub'\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini sa\u011flamada kritik bir rol oynar. Bu makalede, GitHub'\u0131n bu g\u00fc\u00e7l\u00fc \u00f6zelli\u011finin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden bu kadar \u00f6nemli oldu\u011funu ve projelerinizi siber sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilece\u011finizi ad\u0131m ad\u0131m ke\u015ffedece\u011fiz. Ba\u015flamak i\u00e7in haz\u0131r m\u0131s\u0131n\u0131z?","og_url":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-09T01:30:57+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"27 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi","datePublished":"2025-11-09T01:30:57+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/"},"wordCount":4825,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Git"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/","url":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/","name":"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-09T01:30:57+00:00","description":"A\u00e7\u0131k kaynak yaz\u0131l\u0131mlar, modern teknoloji d\u00fcnyas\u0131n\u0131n temel ta\u015flar\u0131ndan biri haline geldi. Ancak bu yayg\u0131n kullan\u0131m, beraberinde ciddi g\u00fcvenlik risklerini de getiriyor. Peki, kulland\u0131\u011f\u0131n\u0131z a\u00e7\u0131k kaynak bile\u015fenlerinin ger\u00e7ekten g\u00fcvende oldu\u011fundan ve \u00fczerinde oynanmad\u0131\u011f\u0131ndan nas\u0131l emin olabilirsiniz? GitHub'\u0131n de\u011fi\u015fmez (immutable) s\u00fcr\u00fcm mekanizmalar\u0131, a\u00e7\u0131k kaynak tedarik zinciri g\u00fcvenli\u011fini sa\u011flamada kritik bir rol oynar. Bu makalede, GitHub'\u0131n bu g\u00fc\u00e7l\u00fc \u00f6zelli\u011finin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden bu kadar \u00f6nemli oldu\u011funu ve projelerinizi siber sald\u0131r\u0131lara kar\u015f\u0131 nas\u0131l koruyabilece\u011finizi ad\u0131m ad\u0131m ke\u015ffedece\u011fiz. Ba\u015flamak i\u00e7in haz\u0131r m\u0131s\u0131n\u0131z?","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/github-immutable-releases-acik-kaynak-tedarik-zinciri-guvenligi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"GitHub Immutable Releases: A\u00e7\u0131k Kaynak Tedarik Zinciri G\u00fcvenli\u011fi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=33941"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33941\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=33941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=33941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=33941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}