A Google bejelentette a Sigstore projektet alkot\u00f3 komponenst biztos\u00edt\u00f3 els\u0151 stabil kiad\u00e1sokat, amelyeket alkalmasnak nyilv\u00e1n\u00edtottak m\u0171k\u00f6d\u0151 bevezet\u00e9sek l\u00e9trehoz\u00e1s\u00e1ra. A Sigstore eszk\u00f6z\u00f6ket \u00e9s szolg\u00e1ltat\u00e1sokat fejleszt a szoftverek hiteles\u00edt\u00e9s\u00e9hez digit\u00e1lis al\u00e1\u00edr\u00e1sokkal \u00e9s egy nyilv\u00e1nos napl\u00f3 vezet\u00e9s\u00e9vel, amely igazolja a m\u00f3dos\u00edt\u00e1sok val\u00f3dis\u00e1g\u00e1t (transparency log). A projektet a Linux Foundation nonprofit szervezet\u00e9nek ir\u00e1ny\u00edt\u00e1sa alatt fejlesztik a Google, a Red Hat, a Cisco, a vmWare, a GitHub \u00e9s a HP Enterprise c\u00e9gek, valamint az OpenSSF (Open Source Security Foundation) szervezet \u00e9s a Purdue Egyetem r\u00e9szv\u00e9tel\u00e9vel. <\/p>\n
A Sigstore-t a k\u00f3dok Let\u2019s Encrypt-jek\u00e9nt lehet felfogni, amely tan\u00fas\u00edtv\u00e1nyokat k\u00edn\u00e1l a k\u00f3d digit\u00e1lis al\u00e1\u00edr\u00e1s\u00e1val \u00e9s automatikus ellen\u0151rz\u00e9sre szolg\u00e1l\u00f3 eszk\u00f6z\u00f6ket biztos\u00edt. A Sigstore seg\u00edts\u00e9g\u00e9vel a fejleszt\u0151k digit\u00e1lis al\u00e1\u00edr\u00e1sokat k\u00e9sz\u00edthetnek a kapcsol\u00f3d\u00f3 alkalmaz\u00e1seelemekhez, p\u00e9ld\u00e1ul kiad\u00e1si f\u00e1jlokhoz, kont\u00e9nerk\u00e9pekhez, manifesztumokhoz \u00e9s v\u00e9grehajthat\u00f3 f\u00e1jlokhoz. Az al\u00e1\u00edrand\u00f3 anyag egy m\u00f3dos\u00edt\u00e1sokt\u00f3l v\u00e9dett nyilv\u00e1nos napl\u00f3ban ker\u00fcl r\u00f6gz\u00edt\u00e9sre, amelyet ellen\u0151rz\u00e9sre \u00e9s audit\u00e1l\u00e1sra lehet haszn\u00e1lni. <\/p>\n
A Sigstore-ban nem \u00e1lland\u00f3 kulcsokat haszn\u00e1lnak, hanem r\u00f6vid \u00e9let\u0171 efemer kulcsokat, amelyeket az OpenID Connect szolg\u00e1ltat\u00f3k \u00e1ltal meger\u0151s\u00edtett jogosults\u00e1gok alapj\u00e1n gener\u00e1lnak (a digit\u00e1lis al\u00e1\u00edr\u00e1s l\u00e9trehoz\u00e1s\u00e1hoz sz\u00fcks\u00e9ges kulcsok gener\u00e1l\u00e1sakor a fejleszt\u0151 az OpenID szolg\u00e1ltat\u00f3n kereszt\u00fcl az email c\u00edm\u00e9vel azonos\u00edtja mag\u00e1t). A kulcsok val\u00f3dis\u00e1ga egy k\u00f6zpontos\u00edtott nyilv\u00e1nos napl\u00f3 alapj\u00e1n ellen\u0151rizhet\u0151, amely lehet\u0151v\u00e9 teszi annak meg\u00e1llap\u00edt\u00e1s\u00e1t, hogy az al\u00e1\u00edr\u00e1s szerz\u0151je val\u00f3ban az, akinek mondja mag\u00e1t, \u00e9s hogy az al\u00e1\u00edr\u00e1st ugyanaz a r\u00e9sztvev\u0151 hozta l\u00e9tre, akik a kor\u00e1bbi kiad\u00e1sok\u00e9rt felel\u0151s volt. <\/p>\n
A Sigstore bevezet\u00e9sre val\u00f3 felk\u00e9sz\u00fclts\u00e9g\u00e9t a k\u00e9t kulcsfontoss\u00e1g\u00fa komponens kiad\u00e1sa hat\u00e1rozza meg \u2014 Rekor 1.0 \u00e9s Fulcio 1.0, amelyek programoz\u00e1si fel\u00fcletei stabilnak vannak nyilv\u00e1n\u00edtva \u00e9s a j\u00f6v\u0151ben visszafel\u00e9 kompatibilisek maradnak. A szolg\u00e1ltat\u00e1s komponensei Go nyelven k\u00e9sz\u00fcltek \u00e9s Apache 2.0 licenc alatt terjesztik. <\/p>\n
A Rekor komponens megval\u00f3s\u00edtja a napl\u00f3t a digit\u00e1lis al\u00e1\u00edr\u00e1sokkal ell\u00e1tott metaadatok t\u00e1rol\u00e1s\u00e1ra, amelyek a projektekkel kapcsolatos inform\u00e1ci\u00f3kat tartalmazz\u00e1k. Az adatok integrit\u00e1s\u00e1nak \u00e9s a h\u00e1tramen\u0151 adats\u00e9r\u00fcl\u00e9s elleni v\u00e9delem \u00e9rdek\u00e9ben egy Merkle-fa strukt\u00fara alkalmaz\u00e1sra ker\u00fcl, ahol minden \u00e1g ellen\u0151rzi az \u00f6sszes alatta l\u00e9v\u0151 \u00e1gat \u00e9s csom\u00f3t a k\u00f6z\u00f6s (f\u00e1s) hash-el\u00e9s seg\u00edts\u00e9g\u00e9vel. A v\u00e9gs\u0151 hash birtok\u00e1ban a felhaszn\u00e1l\u00f3 megbizonyosodhat az \u00f6sszes m\u0171velet helyess\u00e9g\u00e9r\u0151l, valamint a DB kor\u00e1bbi \u00e1llapot\u00e1nak helyess\u00e9g\u00e9r\u0151l (az \u00faj \u00e1llapot gy\u00f6k\u00e9rellen\u0151rz\u0151 hash-e a m\u00faltbeli \u00e1llapot figyelembev\u00e9tel\u00e9vel ker\u00fcl kisz\u00e1m\u00edt\u00e1sra). Az \u00faj bejegyz\u00e9sek ellen\u0151rz\u00e9s\u00e9re \u00e9s hozz\u00e1ad\u00e1s\u00e1ra RESTful API, valamint parancssori fel\u00fclet \u00e1ll rendelkez\u00e9sre. <\/p>\n
The Fulcio component (SigStore WebPKI) includes a system for creating certification authorities (root CA) that issue short-lived certificates based on email authenticated via OpenID Connect. The certificate's lifetime is 20 minutes, during which the developer must create a digital signature (if the certificate later ends up in the hands of an attacker, it will already be expired). Additionally, the project is developing the Cosign (Container Signing) toolkit designed for creating signatures for containers, verifying signatures, and placing signed containers in OCI (Open Container Initiative) compatible repositories. <\/p>\n
Implementing Sigstore enables enhancing the security of software distribution channels and protecting against attacks aimed at substituting libraries and dependencies (supply chain). One of the key security problems in open-source software is the difficulty in verifying the source of obtaining the program and validating the build process. For example, to check the integrity of a release, most projects use hashes, but often the information needed for authenticity verification is stored on unprotected systems and in shared code repositories, where, as a result of compromise, attackers can substitute the necessary verification files and implement malicious changes without raising suspicion. <\/p>\n
A digit\u00e1lis al\u00e1\u00edr\u00e1sok alkalmaz\u00e1sa a kiad\u00e1sok hiteles\u00edt\u00e9s\u00e9re m\u00e9g nem terjedt el sz\u00e9les k\u00f6rben, mivel neh\u00e9zs\u00e9gek mer\u00fclnek fel a kulcsok kezel\u00e9s\u00e9ben, a nyilv\u00e1nos kulcsok terjeszt\u00e9s\u00e9ben \u00e9s a kompromitt\u00e1lt kulcsok visszavon\u00e1s\u00e1ban. Ahhoz, hogy a hiteles\u00edt\u00e9s \u00e9rtelmes legyen, megb\u00edzhat\u00f3 \u00e9s biztons\u00e1gos folyamatot kell l\u00e9trehozni a nyilv\u00e1nos kulcsok \u00e9s ellen\u0151rz\u0151 \u00f6sszegek terjeszt\u00e9s\u00e9re. M\u00e9g digit\u00e1lis al\u00e1\u00edr\u00e1s jelenl\u00e9t\u00e9ben is sok felhaszn\u00e1l\u00f3 figyelmen k\u00edv\u00fcl hagyja a hiteles\u00edt\u00e9st, mert id\u0151t kell \u00e1ldozni a hiteles\u00edt\u00e9si folyamat megismer\u00e9s\u00e9re \u00e9s arra, hogy meg\u00e9rts\u00e9k, melyik kulcs megb\u00edzhat\u00f3. A Sigstore projekt megpr\u00f3b\u00e1lja egyszer\u0171s\u00edteni \u00e9s automatiz\u00e1lni ezeket a folyamatokat, k\u00e9sz \u00e9s bev\u00e1lt megold\u00e1st k\u00edn\u00e1lva. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439. Sigstore \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 (transparency log). \u041f\u0440\u043e\u0435\u043a\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u044d\u0433\u0438\u0434\u043e\u0439 \u043d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Google, Red Hat, Cisco, vmWare, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105382","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A Sigstore k\u00f3dkripto-verifik\u00e1l\u00f3 rendszer k\u00e9szs\u00e9g\u00e9r\u0151l | ProHoster","description":"A Google bejelentette, hogy elk\u00e9sz\u00fclt az els\u0151 stabil verzi\u00f3k a Sigstore projektet alkot\u00f3 komponensekb\u0151l, amelyek alkalmasak munkafelhaszn\u00e1l\u00e1sok l\u00e9trehoz\u00e1s\u00e1ra.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u0433\u043e\u0442\u043e\u0432\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430 Sigstore | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-25T19:36:48+00:00","article:modified_time":"2022-10-25T19:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/105382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=105382"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/105382\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=105382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=105382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=105382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"