{"id":99399,"date":"2021-03-10T16:22:41","date_gmt":"2021-03-10T14:22:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/red-hat-i-google-predstavili-sigstore-servis-dlya-kriptograficheskoj-verifikaczii-koda"},"modified":"2021-03-10T16:22:41","modified_gmt":"2021-03-10T14:22:41","slug":"red-hat-i-google-predstavili-sigstore-servis-dlya-kriptograficheskoj-verifikaczii-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/red-hat-i-google-predstavili-sigstore-servis-dlya-kriptograficheskoj-verifikaczii-koda","title":{"rendered":"Red Hat and Google Introduce Sigstore, a Service for Cryptographic Code Verification","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Red Hat and Google, in collaboration with Purdue University, have established the Sigstore project aimed at creating tools and services for verifying software through digital signatures and maintaining a public log for authenticity confirmation (transparency log). The project will be developed under the auspices of the non-profit organization Linux Foundation. <\/p>\n

The proposed project will enhance the security of software distribution channels and protect against attacks aimed at substituting software components and dependencies (supply chain). One of the key security issues in open-source software is the complexity of verifying the source of a program and validating the build process. For example, many projects use hashes to check the integrity of releases, but often the necessary information for authenticity verification is stored on unsecured systems and in public code repositories. As a result, attackers can compromise these repositories to substitute the required verification files and stealthily inject malicious changes. <\/p>\n

Only a small portion of projects use digital signatures when distributing releases due to difficulties in key management, distributing public keys, and revoking compromised keys. For verification to be meaningful, a reliable and secure process for distributing public keys and checksums also needs to be established. Even with a digital signature in place, many users ignore verification because they must invest time in understanding the verification process and determine which key is trustworthy. <\/p>\n

Sigstore is presented as an alternative to Let’s Encrypt for code, offering certificates for code assurance with digital signatures and tools for automating verification. With Sigstore, developers can create digital signatures for application-related artifacts, such as release files, container images, manifests, and executable files. A distinguishing feature of Sigstore is that the material used for signing is reflected in an immutable public log, which can be used for validation and auditing. <\/p>\n

Instead of permanent keys, Sigstore uses short-lived ephemeral keys that are generated based on credentials verified by OpenID Connect providers (at the moment of key generation for digital signatures, the developer identifies themselves through the OpenID provider linked to their email). The authenticity of the keys is verified through a public centralized log, which ensures that the signature author is indeed who they claim to be and that the signature was created by the same participant responsible for previous releases. <\/p>\n

Sigstore provides both a ready-to-use service and a toolkit that allows for the deployment of similar services on your own infrastructure. The service is free for all developers and software providers, and is hosted on a neutral platform \u2014 the Linux Foundation. All components of the service are open-source, written in Go, and distributed under the Apache 2.0 license. <\/p>\n

Among the developed components, the following can be noted: <\/p>\n