Spole\u010dnost Google ozn\u00e1mila vyd\u00e1n\u00ed prvn\u00edch stabiln\u00edch verz\u00ed komponent\u016f, kter\u00e9 tvo\u0159\u00ed projekt Sigstore, schopn\u00fd pro produk\u010dn\u00ed nasazen\u00ed. Sigstore vyv\u00edj\u00ed n\u00e1stroje a slu\u017eby pro ov\u011b\u0159ov\u00e1n\u00ed softwaru pomoc\u00ed digit\u00e1ln\u00edch podpis\u016f a veden\u00ed ve\u0159ejn\u00e9ho registru, kter\u00fd potvrzuje pravost zm\u011bn (transparency log). Projekt je rozv\u00edjen pod z\u00e1\u0161titou neziskov\u00e9 organizace Linux Foundation ve spolupr\u00e1ci se spole\u010dnostmi Google, Red Hat, Cisco, vmWare, GitHub a HP Enterprise za \u00fa\u010dasti organizace OpenSSF (Open Source Security Foundation) a Purdue University. <\/p>\n
Sigstore lze pova\u017eovat za ekvivalent Let’s Encrypt pro k\u00f3d, kter\u00fd poskytuje certifik\u00e1ty pro ov\u011b\u0159ov\u00e1n\u00ed k\u00f3du digit\u00e1ln\u00edmi podpisy a n\u00e1stroje pro automatizaci kontroly. S pomoc\u00ed Sigstore budou v\u00fdvoj\u00e1\u0159i schopni vytv\u00e1\u0159et digit\u00e1ln\u00ed podpisy pro artefakty souvisej\u00edc\u00ed s aplikacemi, jako jsou soubory s vyd\u00e1n\u00edmi, kontejnery, manifesty a spustiteln\u00e9 soubory. Materi\u00e1l vyu\u017e\u00edvan\u00fd pro podepisov\u00e1n\u00ed je evidov\u00e1n v chr\u00e1n\u011bn\u00e9m ve\u0159ejn\u00e9m den\u00edku, kter\u00fd lze pou\u017e\u00edt pro ov\u011b\u0159en\u00ed a audit. <\/p>\n
M\u00edsto trval\u00fdch kl\u00ed\u010d\u016f pou\u017e\u00edv\u00e1 Sigstore kr\u00e1tkodob\u00e9 efem\u00e9rn\u00ed kl\u00ed\u010de, kter\u00e9 jsou generov\u00e1ny na z\u00e1klad\u011b opr\u00e1vn\u011bn\u00ed potvrzen\u00fdch poskytovateli OpenID Connect (p\u0159i generov\u00e1n\u00ed kl\u00ed\u010d\u016f pot\u0159ebn\u00fdch k vytvo\u0159en\u00ed digit\u00e1ln\u00edho podpisu se v\u00fdvoj\u00e1\u0159 identifikuje prost\u0159ednictv\u00edm poskytovatele OpenID s vazbou na e-mail). Pravost kl\u00ed\u010d\u016f je ov\u011b\u0159ena prost\u0159ednictv\u00edm ve\u0159ejn\u00e9ho centralizovan\u00e9ho registru, kter\u00fd umo\u017e\u0148uje zjistit, \u017ee autor podpisu je skute\u010dn\u011b ten, za koho se vyd\u00e1v\u00e1, a podpis byl vytvo\u0159en stejn\u00fdm \u00fa\u010dastn\u00edkem, kter\u00fd byl odpov\u011bdn\u00fd za p\u0159edchoz\u00ed vyd\u00e1n\u00ed. <\/p>\n
P\u0159ipravenost Sigstore na nasazen\u00ed je d\u00e1na vyd\u00e1n\u00edm dvou kl\u00ed\u010dov\u00fdch komponent — Rekor 1.0 a Fulcio 1.0, jejich\u017e rozhran\u00ed API byla vyhl\u00e1\u0161ena jako stabiln\u00ed a zaji\u0161\u0165uj\u00edc\u00ed zp\u011btnou kompatibilitu. Slu\u017eby byly naps\u00e1ny v jazyce Go a distribuov\u00e1ny pod licenc\u00ed Apache 2.0. <\/p>\n
Komponenta Rekor obsahuje implementaci den\u00edku pro uchov\u00e1v\u00e1n\u00ed ov\u011b\u0159en\u00fdch digit\u00e1ln\u00edmi podpisy metadat, kter\u00e1 odr\u00e1\u017eej\u00ed informace o projektech. Pro zaji\u0161t\u011bn\u00ed integrity a ochranu proti pozd\u011bj\u0161\u00edm \u00faprav\u00e1m dat je pou\u017eita stromov\u00e1 struktura «Merkle\u016fv strom» (Merkle Tree), v n\u00ed\u017e ka\u017ed\u00fd uzel ov\u011b\u0159uje v\u0161echny ni\u017e\u0161\u00ed v\u011btve a uzly pomoc\u00ed spole\u010dn\u00e9ho (stromov\u00e9ho) hashov\u00e1n\u00ed. S kone\u010dn\u00fdm hashem m\u016f\u017ee u\u017eivatel potvrdit spr\u00e1vnost cel\u00e9 historie operac\u00ed a tak\u00e9 spr\u00e1vnost p\u0159edchoz\u00edch stav\u016f datab\u00e1ze (ko\u0159enov\u00fd kontroln\u00ed hash nov\u00e9ho stavu datab\u00e1ze je vypo\u010d\u00edt\u00e1n s ohledem na p\u0159edchoz\u00ed stav). Pro ov\u011b\u0159ov\u00e1n\u00ed a p\u0159id\u00e1v\u00e1n\u00ed nov\u00fdch z\u00e1znam\u016f je k dispozici RESTful API a tak\u00e9 rozhran\u00ed p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku. <\/p>\n
Komponent Fulcio (SigStore WebPKI) zahrnuje syst\u00e9m pro vytv\u00e1\u0159en\u00ed certifika\u010dn\u00edch autorit (root CA), kter\u00e9 vyd\u00e1vaj\u00ed kr\u00e1tkodob\u00e9 certifik\u00e1ty na z\u00e1klad\u011b e-mailu, autentizovan\u00e9ho p\u0159es OpenID Connect. Doba platnosti certifik\u00e1tu \u010din\u00ed 20 minut, b\u011bhem nich\u017e mus\u00ed v\u00fdvoj\u00e1\u0159 stihnout vytvo\u0159it digit\u00e1ln\u00ed podpis (pokud se certifik\u00e1t dostane do rukou \u00fato\u010dn\u00edka, ji\u017e bude neplatn\u00fd). D\u00e1le projekt vyv\u00edj\u00ed n\u00e1stroj Cosign (Container Signing), ur\u010den\u00fd k vytv\u00e1\u0159en\u00ed podpis\u016f pro kontejnery, ov\u011b\u0159ov\u00e1n\u00ed podpis\u016f a umis\u0165ov\u00e1n\u00ed podepsan\u00fdch kontejner\u016f do repozit\u00e1\u0159\u016f kompatibiln\u00edch s OCI (Open Container Initiative). <\/p>\n
Implementace Sigstore umo\u017e\u0148uje zv\u00fd\u0161it bezpe\u010dnost distribu\u010dn\u00edch kan\u00e1l\u016f softwaru a ochr\u00e1nit se p\u0159ed \u00fatoky zam\u011b\u0159en\u00fdmi na nahrazen\u00ed knihoven a z\u00e1vislost\u00ed (supply chain). Jedn\u00edm z kl\u00ed\u010dov\u00fdch probl\u00e9m\u016f bezpe\u010dnosti v otev\u0159en\u00e9m softwaru je slo\u017eitost ov\u011b\u0159en\u00ed zdroje z\u00edsk\u00e1n\u00ed programu a verifikace procesu sestaven\u00ed. Nap\u0159\u00edklad pro ov\u011b\u0159en\u00ed integrity vyd\u00e1n\u00ed v\u011bt\u0161ina projekt\u016f pou\u017e\u00edv\u00e1 hashe, ale \u010dasto nezbytn\u00e9 informace pro ov\u011b\u0159en\u00ed autenticity jsou ulo\u017eeny na nechr\u00e1n\u011bn\u00fdch syst\u00e9mech a ve ve\u0159ejn\u00fdch repozit\u00e1\u0159\u00edch s k\u00f3dem, co\u017e vede k tomu, \u017ee \u00fato\u010dn\u00edci mohou nahradit pot\u0159ebn\u00e9 soubory pro verifikaci a, ani\u017e by to vzbudilo podez\u0159en\u00ed, vlo\u017eit \u0161kodliv\u00e9 zm\u011bny. <\/p>\n
Pou\u017eit\u00ed digit\u00e1ln\u00edch podpis\u016f pro ov\u011b\u0159ov\u00e1n\u00ed vyd\u00e1n\u00ed dosud nez\u00edskalo \u0161irok\u00e9 uplatn\u011bn\u00ed kv\u016fli obt\u00ed\u017e\u00edm p\u0159i spr\u00e1v\u011b kl\u00ed\u010d\u016f, distribuci ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f a odvol\u00e1n\u00ed kompromitovan\u00fdch kl\u00ed\u010d\u016f. Aby ov\u011b\u0159ov\u00e1n\u00ed m\u011blo smysl, je nav\u00edc t\u0159eba zajistit spolehliv\u00fd a bezpe\u010dn\u00fd proces distribuce ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f a hash\u016f. I kdy\u017e je digit\u00e1ln\u00ed podpis k dispozici, mnoho u\u017eivatel\u016f kontrolu ignoruje, proto\u017ee je nutn\u00e9 v\u011bnovat \u010das studiu procesu ov\u011b\u0159ov\u00e1n\u00ed a pochopit, kter\u00fd kl\u00ed\u010d si zaslou\u017e\u00ed d\u016fv\u011bru. Projekt Sigstore se pokou\u0161\u00ed zjednodu\u0161it a automatizovat tyto procesy t\u00edm, \u017ee poskytuje hotov\u00e9 a ov\u011b\u0159en\u00e9 \u0159e\u0161en\u00ed. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439. Sigstore \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 (transparency log). \u041f\u0440\u043e\u0435\u043a\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u044d\u0433\u0438\u0434\u043e\u0439 \u043d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Google, Red Hat, Cisco, vmWare, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105382","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Byla ozn\u00e1mena p\u0159ipravenost syst\u00e9mu kryptografick\u00e9 verifikace k\u00f3du Sigstore | ProHoster","description":"Spole\u010dnost Google ozn\u00e1mila dokon\u010den\u00ed prvn\u00edch stabiln\u00edch vyd\u00e1n\u00ed komponent\u016f, kter\u00e9 tvo\u0159\u00ed projekt Sigstore, kter\u00fd byl prohl\u00e1\u0161en za vhodn\u00fd pro vytv\u00e1\u0159en\u00ed funk\u010dn\u00edch implementac\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u0433\u043e\u0442\u043e\u0432\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430 Sigstore | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-25T19:36:48+00:00","article:modified_time":"2022-10-25T19:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=105382"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105382\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=105382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=105382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=105382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"