{"id":103534,"date":"2022-03-14T15:36:53","date_gmt":"2022-03-14T13:36:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij"},"modified":"2022-03-14T15:36:53","modified_gmt":"2022-03-14T13:36:55","slug":"dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","title":{"rendered":"Dostupn\u00fd TUF 1.0, framework pro organizaci bezpe\u010dn\u00e9 distribuce aktualizac\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byl publikov\u00e1n vyd\u00e1n\u00ed r\u00e1mce TUF 1.0 (The Update Framework), kter\u00fd poskytuje prost\u0159edky pro bezpe\u010dn\u00e9 ov\u011b\u0159ov\u00e1n\u00ed dostupnosti a stahov\u00e1n\u00ed aktualizac\u00ed. Hlavn\u00edm c\u00edlem projektu je chr\u00e1nit klienta p\u0159ed b\u011b\u017en\u00fdmi \u00fatoky na repozit\u00e1\u0159e a infrastrukturu, v\u010detn\u011b boje proti \u0161\u00ed\u0159en\u00ed fale\u0161n\u00fdch aktualizac\u00ed, kter\u00e9 byly vytvo\u0159eny po z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu k kl\u00ed\u010d\u016fm pro generov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f nebo kompromitaci repozit\u00e1\u0159e. Projekt se vyv\u00edj\u00ed pod z\u00e1\u0161titou organizace Linux Foundation a pou\u017e\u00edv\u00e1 se k pos\u00edlen\u00ed bezpe\u010dnosti dod\u00e1v\u00e1n\u00ed aktualizac\u00ed v projektech, jako jsou Docker, Fuchsia, Automotive Grade Linux, Bottlerocket a PyPI (za\u010dlen\u011bn\u00ed ov\u011b\u0159ov\u00e1n\u00ed stahov\u00e1n\u00ed a metadat v PyPI se o\u010dek\u00e1v\u00e1 v bl\u00edzk\u00e9 budoucnosti). K\u00f3d referen\u010dn\u00ed implementace TUF je naps\u00e1n v jazyce Python a \u0161\u00ed\u0159\u00ed se pod licenc\u00ed Apache 2.0. <\/p>\n

Projekt vyv\u00edj\u00ed \u0159adu knihoven, form\u00e1t\u016f soubor\u016f a utilit, kter\u00e9 se mohou snadno integrovat do st\u00e1vaj\u00edc\u00edch syst\u00e9m\u016f aktualizace aplikac\u00ed a poskytuj\u00ed ochranu v p\u0159\u00edpad\u011b kompromitace kl\u00ed\u010d\u016f na stran\u011b v\u00fdvoj\u00e1\u0159\u016f softwaru. Pro pou\u017eit\u00ed TUF sta\u010d\u00ed p\u0159idat do repozit\u00e1\u0159e nezbytn\u00e1 metadata a do klientsk\u00e9ho k\u00f3du integrovat poskytnut\u00e9 v TUF procedury pro stahov\u00e1n\u00ed a ov\u011b\u0159ov\u00e1n\u00ed soubor\u016f. <\/p>\n

R\u00e1mec TUF se uj\u00edm\u00e1 \u00fakol\u016f ov\u011b\u0159ov\u00e1n\u00ed vzniku aktualizace, stahov\u00e1n\u00ed aktualizace a ov\u011b\u0159ov\u00e1n\u00ed jej\u00ed integrity. Syst\u00e9m instalace aktualizac\u00ed se p\u0159\u00edmo nespojuje s dodate\u010dn\u00fdmi metadaty, jejich\u017e ov\u011b\u0159ov\u00e1n\u00ed a stahov\u00e1n\u00ed m\u00e1 na starosti TUF. Pro integraci s aplikacemi a syst\u00e9my instalace aktualizac\u00ed je nab\u00edzen n\u00edzko\u00farov\u0148ov\u00fd API pro p\u0159\u00edstup k metadat\u016fm a realizace vysoce\u00farov\u0148ov\u00e9ho klientsk\u00e9ho API ngclient, kter\u00e9 je p\u0159ipraveno pro integraci s aplikacemi. <\/p>\n

Mezi \u00fatoky, proti nim\u017e m\u016f\u017ee TUF \u00fa\u010dinn\u011b zas\u00e1hnout, pat\u0159\u00ed podstr\u010den\u00ed star\u00fdch vyd\u00e1n\u00ed pod z\u00e1minkou aktualizac\u00ed s c\u00edlem zablokovat opravu zranitelnost\u00ed v softwaru nebo vr\u00e1cen\u00ed u\u017eivatele na starou zranitelnou verzi, stejn\u011b jako \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00fdch aktualizac\u00ed, kter\u00e9 jsou spr\u00e1vn\u011b podeps\u00e1ny pomoc\u00ed kompromitovan\u00e9ho kl\u00ed\u010de, a prov\u00e1d\u011bn\u00ed DoS \u00fatok\u016f na klienty, jako je nap\u0159\u00edklad zapln\u011bn\u00ed disku nekone\u010dnou aktualizac\u00ed. <\/p>\n

Ochrana p\u0159ed kompromitac\u00ed infrastruktury dodavatele softwaru je zaji\u0161t\u011bna udr\u017eov\u00e1n\u00edm samostatn\u00fdch ov\u011b\u0159iteln\u00fdch z\u00e1znam\u016f o stavu repozit\u00e1\u0159e nebo aplikace. Ov\u011b\u0159iteln\u00e1 meta\u00fadaje TUF zahrnuj\u00ed informace o kl\u00ed\u010d\u00edch, kter\u00fdm lze d\u016fv\u011b\u0159ovat, kryptografick\u00e9 hash hodnoty pro posouzen\u00ed integrity soubor\u016f, dal\u0161\u00ed digit\u00e1ln\u00ed podpisy pro potvrzen\u00ed metadata, \u00fadaje o \u010d\u00edslech verz\u00ed a informace o \u017eivotnosti z\u00e1znam\u016f. Pou\u017e\u00edvan\u00e9 k ov\u011b\u0159ov\u00e1n\u00ed kl\u00ed\u010de maj\u00ed omezenou \u017eivotnost a vy\u017eaduj\u00ed neust\u00e1lou aktualizaci, aby se ochr\u00e1nily p\u0159ed podepisov\u00e1n\u00edm star\u00fdmi kl\u00ed\u010di. <\/p>\n

Sni\u017eov\u00e1n\u00ed rizika kompromitace cel\u00e9ho syst\u00e9mu je realizov\u00e1no pomoc\u00ed modelu s rozd\u011blen\u00edm d\u016fv\u011bry, ve kter\u00e9m je ka\u017ed\u00e1 strana omezena pouze na tu oblast, za kterou p\u0159\u00edmo odpov\u00edd\u00e1. V syst\u00e9mu je pou\u017eita hierarchie rol\u00ed s vlastn\u00edmi kl\u00ed\u010di, nap\u0159\u00edklad root role podepisuje kl\u00ed\u010de pro role odpov\u011bdn\u00e9 za metadata v repozit\u00e1\u0159i, \u00fadaje o \u010dase vytvo\u0159en\u00ed aktualizac\u00ed a c\u00edlov\u00e9 sestavy, na co\u017e role odpov\u011bdn\u00e1 za sestavy podepisuje role souvisej\u00edc\u00ed s potvrzov\u00e1n\u00edm dod\u00e1van\u00fdch soubor\u016f.

\"Dostupn\u00fd<\/center> <\/p>\n

Pro ochranu p\u0159ed kompromitac\u00ed kl\u00ed\u010d\u016f se pou\u017e\u00edv\u00e1 mechanismus rychl\u00e9ho odvol\u00e1n\u00ed a nahrazen\u00ed kl\u00ed\u010d\u016f. V ka\u017ed\u00e9m jednotliv\u00e9m kl\u00ed\u010di jsou soust\u0159ed\u011bny pouze minim\u00e1ln\u011b nezbytn\u00e9 pravomoci, a pro operace potvrzov\u00e1n\u00ed je t\u0159eba pou\u017e\u00edt n\u011bkolik kl\u00ed\u010d\u016f (\u00fanik jednotliv\u00e9ho kl\u00ed\u010de neumo\u017e\u0148uje okam\u017eit\u00fd \u00fatok na klienta, a pro kompromitaci cel\u00e9ho syst\u00e9mu je nutn\u00e9 z\u00edskat kl\u00ed\u010de v\u0161ech \u00fa\u010dastn\u00edk\u016f). Klient m\u016f\u017ee p\u0159ij\u00edmat pouze soubory, kter\u00e9 byly vytvo\u0159eny pozd\u011bji ne\u017e ji\u017e d\u0159\u00edve z\u00edskan\u00e9 soubory, a data jsou nahr\u00e1v\u00e1na pouze v souladu s velikost\u00ed uvedenou v ov\u011b\u0159en\u00fdch metadatech. <\/p>\n

Uve\u0159ejn\u011bn\u00e1 verze TUF 1.0.0 nab\u00edz\u00ed zcela p\u0159epracovanou a stabilizovanou referen\u010dn\u00ed implementaci specifikace TUF, kterou lze vyu\u017e\u00edt jako hotov\u00fd p\u0159\u00edklad p\u0159i vytv\u00e1\u0159en\u00ed vlastn\u00edch implementac\u00ed nebo pro integraci do sv\u00fdch projekt\u016f. Nov\u00e1 implementace obsahuje podstatn\u011b m\u00e9n\u011b k\u00f3du (1400 \u0159\u00e1dk\u016f m\u00edsto 4700), je snadn\u011bji udr\u017eovateln\u00e1 a m\u016f\u017ee b\u00fdt snadno roz\u0161i\u0159ov\u00e1na, nap\u0159\u00edklad v p\u0159\u00edpad\u011b pot\u0159eby p\u0159id\u00e1n\u00ed podpory specifick\u00fdch s\u00ed\u0165ov\u00fdch z\u00e1sobn\u00edk\u016f, \u00falo\u017en\u00fdch syst\u00e9m\u016f nebo \u0161ifrovac\u00edch algoritm\u016f.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 TUF 1.0 (The Update Framework), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0437\u0430\u0449\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043e\u0442 \u0442\u0438\u043f\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0438\u043b\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f. \u041f\u0440\u043e\u0435\u043a\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u044d\u0433\u0438\u0434\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TUF 1.0 je dostupn\u00fd, r\u00e1mec pro organizaci bezpe\u010dn\u00e9 distribuce aktualizac\u00ed | ProHoster","description":"Byl zve\u0159ejn\u011bn vyd\u00e1n\u00ed r\u00e1mce TUF 1.0 (The Update Framework), kter\u00fd poskytuje prost\u0159edky pro bezpe\u010dn\u00e9 ov\u011b\u0159ov\u00e1n\u00ed p\u0159\u00edtomnosti a stahov\u00e1n\u00ed aktualizac\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d TUF 1.0, \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 TUF 1.0 (The Update Framework), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-14T13:36:55+00:00","article:modified_time":"2022-03-14T13:36:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103534","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-14 13:37:57","updated":"2022-09-29 02:42:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/103534","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=103534"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/103534\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/103535"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=103534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=103534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=103534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}