GitHub has proposed the implementation of the Sigstore service for verifying packages via digital signatures and maintaining a public log to confirm authenticity during release distribution. The use of Sigstore will provide an additional layer of protection against attacks aimed at substituting software components and dependencies (supply chain). For instance, this change will protect the source code of projects in the event of a developer account compromise of one of the dependencies in NPM, where a malicious actor might generate a package update with harmful code.
With the new level of protection, developers will be able to link the generated package to the source code and build environment used, allowing users to verify that the package content matches the content of the source code in the project's main repository. The application of Sigstore significantly simplifies key management and eliminates the complexities associated with the registration, revocation, and management of cryptographic keys. Sigstore is presented as an equivalent to Let’s Encrypt for code, providing certificates for code attestation via digital signatures and tools for automating verification.
Instead of permanent keys, Sigstore uses short-lived ephemeral keys generated based on authorizations. The material used for signing is reflected in an immutable public log that assures users that the signature author is indeed who they claim to be, and that the signature was created by the same participant responsible for previous releases. To ensure integrity and protect against backdating data tampering, a tree structure known as a Merkle Tree is utilized, in which each branch verifies all lower branches and nodes through shared (tree-based) hashing. With the final hash, users can confirm the correctness of the entire operation history and the accuracy of past database states (the root hash of the new database state is calculated based on the previous state).
Source: opennet.ru
