A GitHub el\u0151terjeszt\u00e9se vit\u00e1ra bocs\u00e1totta a Sigstore szolg\u00e1ltat\u00e1s bevezet\u00e9s\u00e9nek javaslat\u00e1t, amely digit\u00e1lis al\u00e1\u00edr\u00e1sokkal hiteles\u00edti a csomagokat \u00e9s nyilv\u00e1nos napl\u00f3t vezet a kiad\u00e1sok val\u00f3dis\u00e1g\u00e1nak igazol\u00e1s\u00e1ra. A Sigstore alkalmaz\u00e1sa lehet\u0151v\u00e9 teszi egy tov\u00e1bbi v\u00e9delmi szint bevezet\u00e9s\u00e9t a szoftverkomponensek \u00e9s a f\u00fcgg\u0151s\u00e9gek (supply chain) manipul\u00e1l\u00e1s\u00e1ra ir\u00e1nyul\u00f3 t\u00e1mad\u00e1sokkal szemben. P\u00e9ld\u00e1ul a bevezet\u00e9sre ker\u00fcl\u0151 v\u00e1ltoz\u00e1s megv\u00e9di a projektek forr\u00e1sk\u00f3dj\u00e1t, ha egy NPM-f\u00fcgg\u0151s\u00e9g fejleszt\u0151i fi\u00f3kj\u00e1t kompromitt\u00e1lj\u00e1k, \u00e9s a t\u00e1mad\u00f3 rosszindulat\u00fa k\u00f3d\u00fa csomagfriss\u00edt\u00e9st hoz l\u00e9tre. <\/p>\n
Az \u00faj v\u00e9delmi szintnek k\u00f6sz\u00f6nhet\u0151en a fejleszt\u0151k hozz\u00e1rendelhetik a l\u00e9trehozott csomagot a haszn\u00e1lt forr\u00e1sk\u00f3dhoz \u00e9s a build k\u00f6rnyezethez, lehet\u0151v\u00e9 t\u00e9ve a felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra, hogy ellen\u0151rizze, hogy a csomag tartalma megfelel a projekt f\u0151 t\u00e1rol\u00f3j\u00e1ban tal\u00e1lhat\u00f3 forr\u00e1sf\u00e1jloknak. A Sigstore haszn\u00e1lata jelent\u0151sen leegyszer\u0171s\u00edti a kulcsmennyis\u00e9gek kezel\u00e9s\u00e9t, valamint megsz\u00fcnteti a kriptogr\u00e1fikus kulcsok regisztr\u00e1l\u00e1s\u00e1val, visszavon\u00e1s\u00e1val \u00e9s kezel\u00e9s\u00e9vel kapcsolatos neh\u00e9zs\u00e9geket. A Sigstore \u00fagy ker\u00fcl bemutat\u00e1sra, mint a Let's Encrypt anal\u00f3gja k\u00f3d eset\u00e9ben, amely tan\u00fas\u00edtv\u00e1nyokat biztos\u00edt a k\u00f3d digit\u00e1lis al\u00e1\u00edr\u00e1sokkal val\u00f3 hiteles\u00edt\u00e9s\u00e9hez \u00e9s eszk\u00f6z\u00f6ket az ellen\u0151rz\u00e9s automatiz\u00e1l\u00e1s\u00e1hoz. <\/p>\n
A Sigstore-ban nem \u00e1lland\u00f3 kulcsok haszn\u00e1latosak, hanem r\u00f6vid \u00e9letidej\u0171 ideiglenes kulcsok, amelyeket a jogosults\u00e1gok alapj\u00e1n gener\u00e1lnak. Az al\u00e1\u00edr\u00e1sra haszn\u00e1lt anyag egy m\u00f3dos\u00edt\u00e1sokt\u00f3l v\u00e9dett, nyilv\u00e1nos napl\u00f3ban van r\u00f6gz\u00edtve, amely lehet\u0151v\u00e9 teszi, hogy megbizonyosodjunk arr\u00f3l, hogy az al\u00e1\u00edr\u00f3 val\u00f3ban az, akinek mondja mag\u00e1t, \u00e9s hogy az al\u00e1\u00edr\u00e1st az a r\u00e9sztvev\u0151 k\u00e9sz\u00edtette, aki a kor\u00e1bbi kiad\u00e1sok\u00e9rt is felelt. Az integrit\u00e1s \u00e9s az id\u0151ben t\u00f6rt\u00e9n\u0151 adathiba elker\u00fcl\u00e9se \u00e9rdek\u00e9ben a Merkle Fa n\u00e9ven ismert fa-strukt\u00far\u00e1ra t\u00e1maszkodunk, amelyben minden \u00e1g ellen\u0151rzi az alatta l\u00e9v\u0151 \u00e1gakat \u00e9s csom\u00f3pontokat k\u00f6z\u00f6s (fa alap\u00fa) hash alkalmaz\u00e1s\u00e1val. A v\u00e9gs\u0151 hash birtok\u00e1ban a felhaszn\u00e1l\u00f3 megbizonyosodhat az \u00f6sszes m\u0171velet helyess\u00e9g\u00e9r\u0151l, valamint a DB kor\u00e1bbi \u00e1llapotainak helyess\u00e9g\u00e9r\u0151l (az \u00faj \u00e1llapot gy\u00f6k\u00e9r ellen\u0151rz\u0151 hash-e a kor\u00e1bbi \u00e1llapot figyelembev\u00e9tel\u00e9vel ker\u00fcl kisz\u00e1m\u00edt\u00e1sra). GitHub \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Sigstore \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u043e\u0432. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 Sigstore \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (supply chain). \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u043c\u043e\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u0449\u0438\u0442\u0438\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104805","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Az NPM tervezi a Sigstore alkalmaz\u00e1s\u00e1t a csomagok hiteles\u00edt\u00e9s\u00e9re | ProHoster","description":"A GitHub felv\u00e1zolt egy javaslatot a Sigstore szolg\u00e1ltat\u00e1s bevezet\u00e9s\u00e9re a csomagok digit\u00e1lis al\u00e1\u00edr\u00e1s szerinti ellen\u0151rz\u00e9s\u00e9re \u00e9s egy nyilv\u00e1nos napl\u00f3 vezet\u00e9s\u00e9re az \u00e9szlelts\u00e9g hiteles\u00edt\u00e9s\u00e9nek meger\u0151s\u00edt\u00e9se \u00e9rdek\u00e9ben a kiad\u00e1sok terjeszt\u00e9se sor\u00e1n.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 NPM \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Sigstore \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043f\u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Sigstore \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-npm-planiruyut-ispolzovat-sigstore-dlya-podtverzhdeniya-podlinnosti-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-09T13:37:11+00:00","article:modified_time":"2022-08-09T13:37:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104805","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-09 13:38:12","updated":"2022-09-30 00:16:55","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/104805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=104805"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/104805\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=104805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=104805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=104805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"