Google has announced the creation of the first stable releases of the components forming the Sigstore project, which is deemed suitable for building production deployments. Sigstore develops tools and services for verifying software using digital signatures and maintaining a public log that verifies the authenticity of changes (transparency log). The project is being developed under the auspices of the non-profit organization Linux Foundation by Google, Red Hat, Cisco, VMware, GitHub, and HP Enterprise, with the participation of the OpenSSF (Open Source Security Foundation) and Purdue University. <\/p>\n
Sigstore can be seen as an equivalent of Let\u2019s Encrypt for code, providing certificates for code attestation through digital signatures and a toolkit for automating verification. With Sigstore, developers will be able to generate digital signatures for application-related artifacts such as release files, container images, manifests, and executable files. The signed material is reflected in a tamper-proof public log that can be used for verification and auditing. <\/p>\n
Instead of permanent keys, Sigstore uses short-lived ephemeral keys that are generated based on credentials verified by OpenID Connect providers (at the time of generating the keys needed to create a digital signature, the developer identifies themselves through the OpenID provider tied to their email). The authenticity of the keys is verified through a public centralized log that ensures the signer is who they claim to be and that the signature was created by the same participant responsible for previous releases. <\/p>\n
The readiness of Sigstore for implementation is due to the release of two key components \u2014 Rekor 1.0 and Fulcio 1.0, whose APIs are declared stable and will maintain backward compatibility. The service components are written in Go and are distributed under the Apache 2.0 license. <\/p>\n
The Rekor component contains an implementation of a log for storing metadata attested by digital signatures, reflecting information about projects. To ensure integrity and protection against data tampering, a tree structure known as a 'Merkle Tree' is used, where each branch verifies all underlying branches and nodes through collaborative (tree-based) hashing. With a final hash, a user can verify the correctness of the entire operation history as well as the accuracy of past database states (the root verification hash of the new database state is calculated based on the previous state). A RESTful API is provided for verification and adding new records, as well as a command-line interface. <\/p>\n
The Fulcio component (SigStore WebPKI) includes a system for creating certification authorities (root CAs) that issue short-lived certificates based on email authenticated via OpenID Connect. The certificate has a lifetime of 20 minutes, during which the developer must complete the digital signature (if the certificate later gets into the hands of an attacker, it will have already expired). Additionally, the project is developing the Cosign (Container Signing) toolkit, which is intended for creating signatures for containers, verifying signatures, and storing signed containers in OCI-compatible repositories. <\/p>\n
The implementation of Sigstore enables enhanced security for software distribution channels and protection against attacks aimed at substituting libraries and dependencies (supply chain). One of the key security challenges in open-source software is the difficulty of verifying the source of the program and the authenticity of the build process. For instance, most projects use hashes to verify the integrity of releases, but the information needed for authenticity checks is often stored in unsecured systems and shared code repositories. As a result, if these are compromised, attackers can replace the necessary verification files, infiltrating malicious changes without raising suspicion. <\/p>\n