GitHub ha propuesto la implementaci\u00f3n del servicio Sigstore para la verificaci\u00f3n de paquetes mediante firmas digitales y el mantenimiento de un registro p\u00fablico para confirmar la autenticidad en la distribuci\u00f3n de lanzamientos. La aplicaci\u00f3n de Sigstore permitir\u00e1 a\u00f1adir un nivel adicional de protecci\u00f3n contra ataques dirigidos a la sustituci\u00f3n de componentes de software y dependencias (supply chain). Por ejemplo, el cambio implementado proteger\u00e1 los c\u00f3digos fuente de los proyectos en caso de compromiso de la cuenta del desarrollador de una de las dependencias en NPM y la creaci\u00f3n de una actualizaci\u00f3n del paquete con c\u00f3digo malicioso por parte de un atacante. <\/p>\n
Gracias a un nuevo nivel de protecci\u00f3n, los desarrolladores podr\u00e1n vincular el paquete generado con el c\u00f3digo fuente utilizado y el entorno de construcci\u00f3n, brindando al usuario la posibilidad de asegurarse de que el contenido del paquete coincide con el contenido de los textos fuente en el repositorio principal del proyecto. La aplicaci\u00f3n de Sigstore simplifica considerablemente el proceso de gesti\u00f3n de claves y elimina las complicaciones relacionadas con el registro, revocaci\u00f3n y gesti\u00f3n de claves criptogr\u00e1ficas. Sigstore se presenta como un equivalente de Let's Encrypt para el c\u00f3digo, proporcionando certificados para la verificaci\u00f3n del c\u00f3digo con firmas digitales y herramientas para la automatizaci\u00f3n de la verificaci\u00f3n. <\/p>\n
En lugar de claves permanentes, Sigstore utiliza claves ef\u00edmeras de corta duraci\u00f3n que se generan en funci\u00f3n de las credenciales. El material utilizado para la firma se refleja en un registro p\u00fablico protegido contra modificaciones, lo que permite confirmar que el autor de la firma es efectivamente quien dice ser y que la firma fue generada por el mismo participante que fue responsable de lanzamientos anteriores. Para asegurar la integridad y proteger contra la alteraci\u00f3n de datos retroactiva, se aplica una estructura de \u00e1rbol conocida como '\u00e1rbol de Merkle', en la cual cada rama verifica todas las ramas y nodos inferiores mediante el hash compartido (en forma de \u00e1rbol). Con un hash final, el usuario puede confirmar la validez de toda la historia de operaciones y la validez de los estados anteriores de la base de datos (el hash de verificaci\u00f3n ra\u00edz del nuevo estado de la base se calcula teniendo en cuenta el estado anterior). GitHub \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Sigstore \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u043e\u0432. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 Sigstore \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (supply chain). \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u043c\u043e\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u0449\u0438\u0442\u0438\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104805","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47En NPM planean usar Sigstore para confirmar la autenticidad de los paquetes | ProHoster","description":"GitHub ha puesto a discusi\u00f3n una propuesta para implementar el servicio Sigstore para la verificaci\u00f3n de paquetes mediante firmas digitales y llevar un registro p\u00fablico que confirme la autenticidad en la distribuci\u00f3n de lanzamientos.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 NPM \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Sigstore \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Sigstore \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-09T13:37:11+00:00","article:modified_time":"2022-08-09T13:37:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104805","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-09 13:38:12","updated":"2022-09-30 00:16:55","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/104805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=104805"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/104805\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=104805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=104805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=104805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fuente: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"