{"id":104805,"date":"2022-08-09T15:37:11","date_gmt":"2022-08-09T13:37:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov"},"modified":"2022-08-09T15:37:11","modified_gmt":"2022-08-09T13:37:11","slug":"v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","title":{"rendered":"Dans NPM, l'utilisation de Sigstore est pr\u00e9vue pour la validation d'authenticit\u00e9 des paquets.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub a propos\u00e9 de discuter de l'impl\u00e9mentation du service Sigstore pour la v\u00e9rification des paquets par signatures num\u00e9riques et la tenue d'un registre public pour confirmer l'authenticit\u00e9 lors de la diffusion des versions. L'application de Sigstore permettra de r\u00e9aliser un niveau de protection suppl\u00e9mentaire contre les attaques visant \u00e0 substituer des composants et des d\u00e9pendances logiciels (supply chain). Par exemple, cette modification apportera une protection aux codes sources des projets en cas de compromission du compte d\u00e9veloppeur d'une des d\u00e9pendances dans NPM, permettant \u00e0 un attaquant de cr\u00e9er une mise \u00e0 jour de paquet avec un code malveillant. <\/p>\n

Gr\u00e2ce \u00e0 un nouveau niveau de protection, les d\u00e9veloppeurs pourront lier le paquet g\u00e9n\u00e9r\u00e9 au code source utilis\u00e9 et \u00e0 l'environnement de construction, permettant \u00e0 l'utilisateur de v\u00e9rifier que le contenu du paquet correspond \u00e0 celui des textes sources dans le r\u00e9f\u00e9rentiel principal du projet. L'application de Sigstore simplifie consid\u00e9rablement le processus de gestion des cl\u00e9s et permet d'\u00e9liminer les complexit\u00e9s li\u00e9es \u00e0 l'enregistrement, \u00e0 la r\u00e9vocation et \u00e0 la gestion des cl\u00e9s cryptographiques. Sigstore est pr\u00e9sent\u00e9 comme l'\u00e9quivalent de Let's Encrypt pour le code, fournissant des certificats pour la validation du code par des signatures num\u00e9riques et un ensemble d'outils pour automatiser la v\u00e9rification. <\/p>\n

Au lieu de cl\u00e9s permanentes, Sigstore utilise des cl\u00e9s \u00e9ph\u00e9m\u00e8res \u00e0 dur\u00e9e de vie courte, g\u00e9n\u00e9r\u00e9es sur la base des autorisations. Le mat\u00e9riel utilis\u00e9 pour la signature est refl\u00e9t\u00e9 dans un registre public prot\u00e9g\u00e9 contre les modifications, qui permet de s'assurer que l'auteur de la signature est bien celui qu'il pr\u00e9tend \u00eatre et que la signature a \u00e9t\u00e9 produite par le m\u00eame participant responsable des versions pr\u00e9c\u00e9dentes. Pour garantir l'int\u00e9grit\u00e9 et prot\u00e9ger contre la falsification des donn\u00e9es, une structure arborescente appel\u00e9e \u00ab arbre de Merkle \u00bb est utilis\u00e9e, dans laquelle chaque branche v\u00e9rifie toutes les branches et n\u0153uds inf\u00e9rieurs gr\u00e2ce \u00e0 un hachage commun (arborescent). Avec un hachage final, l'utilisateur peut s'assurer de la validit\u00e9 de l'ensemble de l'historique des op\u00e9rations ainsi que de la validit\u00e9 des \u00e9tats pr\u00e9c\u00e9dents de la base de donn\u00e9es (le hachage de v\u00e9rification racine du nouvel \u00e9tat de la base est calcul\u00e9 en tenant compte de l'\u00e9tat pr\u00e9c\u00e9dent).
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Sigstore \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u043e\u0432. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 Sigstore \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (supply chain). \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u043c\u043e\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u0449\u0438\u0442\u0438\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104805","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dans NPM, ils envisagent d'utiliser Sigstore pour confirmer l'authenticit\u00e9 des paquets | ProHoster","description":"GitHub a soumis \u00e0 discussion une proposition d'impl\u00e9mentation du service Sigstore pour la v\u00e9rification des paquets par signatures num\u00e9riques et la tenue d'un registre public pour confirmer l'authenticit\u00e9 lors de la diffusion des versions.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 NPM \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Sigstore \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Sigstore \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-09T13:37:11+00:00","article:modified_time":"2022-08-09T13:37:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104805","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-09 13:38:12","updated":"2022-09-30 00:16:55","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=104805"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104805\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=104805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=104805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=104805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}