{"id":104805,"date":"2022-08-09T15:37:11","date_gmt":"2022-08-09T13:37:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov"},"modified":"2022-08-09T15:37:11","modified_gmt":"2022-08-09T13:37:11","slug":"v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","title":{"rendered":"NPM plans to use Sigstore for package authenticity verification.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub has proposed the implementation of the Sigstore service for verifying packages via digital signatures and maintaining a public log to confirm authenticity during release distribution. The use of Sigstore will provide an additional layer of protection against attacks aimed at substituting software components and dependencies (supply chain). For instance, this change will protect the source code of projects in the event of a developer account compromise of one of the dependencies in NPM, where a malicious actor might generate a package update with harmful code. <\/p>\n
With the new level of protection, developers can bind the generated package to the source code and build environment used, allowing users to verify that the package content matches the content of the source texts in the main project repository. The implementation of Sigstore significantly simplifies the key management process and eliminates complexities associated with the registration, revocation, and management of cryptographic keys. Sigstore is presented as an equivalent to Let's Encrypt for code, providing certificates for code attestation with digital signatures and tools for automating verification. <\/p>\n
Instead of permanent keys, Sigstore uses short-lived ephemeral keys that are generated based on the credentials. The material used for signing is reflected in a tamper-proof public log, which ensures that the signature author is indeed who they claim to be, and the signature is made by the same participant responsible for previous releases. To ensure integrity and protection against data tampering retroactively, a tree structure known as a \"Merkle Tree\" is used, where each branch verifies all subordinate branches and nodes through collaborative (tree-like) hashing. With a final hash, a user can verify the correctness of the entire operation history as well as the accuracy of past states of the database (the root verification hash of the new state of the database is computed based on the past state). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"