Red Hat and Google, in collaboration with Purdue University, have established the Sigstore project aimed at creating tools and services for verifying software through digital signatures and maintaining a public log for authenticity confirmation (transparency log). The project will be developed under the auspices of the non-profit organization Linux Foundation.
The proposed project will enhance the security of software distribution channels and protect against attacks aimed at substituting software components and dependencies (supply chain). One of the key security issues in open-source software is the complexity of verifying the source of a program and validating the build process. For example, many projects use hashes to check the integrity of releases, but often the necessary information for authenticity verification is stored on unsecured systems and in public code repositories. As a result, attackers can compromise these repositories to substitute the required verification files and stealthily inject malicious changes.
Only a small portion of projects use digital signatures when distributing releases due to difficulties in key management, distributing public keys, and revoking compromised keys. For verification to be meaningful, a reliable and secure process for distributing public keys and checksums also needs to be established. Even with a digital signature in place, many users ignore verification because they must invest time in understanding the verification process and determine which key is trustworthy.
Sigstore is presented as an equivalent of Let’s Encrypt for code, providing certificates for attesting code with digital signatures and tools for automating verification. With Sigstore, developers will be able to create digital signatures for application-related artifacts such as release files, container images, manifests, and executables. A distinctive feature of Sigstore is that the material used for signing is reflected in an immutable public log, which can be used for verification and auditing.
Instead of permanent keys, Sigstore uses short-lived ephemeral keys that are generated based on credentials verified by OpenID Connect providers (at the moment of key generation for digital signatures, the developer identifies themselves through the OpenID provider linked to their email). The authenticity of the keys is verified through a public centralized log, which ensures that the signature author is indeed who they claim to be and that the signature was created by the same participant responsible for previous releases.
Sigstore offers both a ready-to-use service and a set of tools that allow for the deployment of similar services on one's own equipment. The service is free for all developers and software providers and is hosted on a neutral platform - the Linux Foundation. All components of the service are open source, written in Go, and distributed under the Apache 2.0 license.
Among the developed components, the following can be noted:
- Rekor - an implementation of a log for storing metadata certified with digital signatures, reflecting information about projects. To ensure integrity and protection against retroactive data distortion, a tree structure known as the 'Merkle Tree' is used, where each branch verifies all underlying branches and nodes through collaborative (tree-based) hashing. With a final hash, users can verify the correctness of the entire history of operations, as well as the accuracy of previous database states (the root verification hash of the new database state is computed based on the previous state). A Restful API is provided for verification and adding new entries, as well as a CLI interface.
- Fulcio (SigStore WebPKI) - a system for creating certificate authorities (Root-CA) that issue short-lived certificates based on email authenticated through OpenID Connect. The certificate's lifetime is 20 minutes, during which the developer must create a digital signature (if the certificate subsequently falls into the hands of a malicious actor, it will already be expired).
- Cosign (Container Signing) - a toolkit for creating signatures for containers, verifying signatures, and storing signed containers in OCI (Open Container Initiative) compatible repositories.
Source: opennet.ru
