A empresa Google anunciou a forma\u00e7\u00e3o das primeiras vers\u00f5es est\u00e1veis dos componentes que comp\u00f5em o projeto Sigstore, que foi declarado adequado para a cria\u00e7\u00e3o de implementa\u00e7\u00f5es em produ\u00e7\u00e3o. O Sigstore desenvolve ferramentas e servi\u00e7os para a verifica\u00e7\u00e3o de software usando assinaturas digitais e mantendo um log p\u00fablico que confirma a autenticidade das mudan\u00e7as (transparency log). O projeto \u00e9 desenvolvido sob a \u00e9gide da organiza\u00e7\u00e3o sem fins lucrativos Linux Foundation, junto com as empresas Google, Red Hat, Cisco, VMware, GitHub e HP Enterprise, com a participa\u00e7\u00e3o da organiza\u00e7\u00e3o OpenSSF (Open Source Security Foundation) e da Universidade de Purdue. <\/p>\n
O Sigstore pode ser considerado an\u00e1logo ao Let's Encrypt para c\u00f3digo, fornecendo certificados para a certifica\u00e7\u00e3o de c\u00f3digo com assinaturas digitais e um conjunto de ferramentas para automatizar a verifica\u00e7\u00e3o. Com o Sigstore, os desenvolvedores poder\u00e3o gerar assinaturas digitais para artefatos relacionados ao aplicativo, como arquivos de lan\u00e7amento, imagens de cont\u00eaineres, manifests e arquivos execut\u00e1veis. O material utilizado para a assinatura \u00e9 refletido em um log p\u00fablico protegido contra altera\u00e7\u00f5es, que pode ser utilizado para verifica\u00e7\u00e3o e auditoria. <\/p>\n
Em vez de chaves permanentes, o Sigstore utiliza chaves ef\u00eameras de curta dura\u00e7\u00e3o, que s\u00e3o geradas com base em credenciais validadas por provedores OpenID Connect (no momento da gera\u00e7\u00e3o de chaves, necess\u00e1rias para criar uma assinatura digital, o desenvolvedor se identifica atrav\u00e9s do provedor OpenID vinculado ao email). A autenticidade das chaves \u00e9 verificada por um log p\u00fablico centralizado, que permite garantir que o autor da assinatura \u00e9 realmente quem afirma ser, e que a assinatura foi criada pelo mesmo participante respons\u00e1vel pelas vers\u00f5es anteriores. <\/p>\n
A prontid\u00e3o do Sigstore para implementa\u00e7\u00e3o \u00e9 resultado da libera\u00e7\u00e3o de dois componentes-chave - Rekor 1.0 e Fulcio 1.0, cujas interfaces de programa\u00e7\u00e3o foram declaradas est\u00e1veis e manter\u00e3o a compatibilidade retroativa. Os componentes do servi\u00e7o s\u00e3o escritos na linguagem Go e distribu\u00eddos sob a licen\u00e7a Apache 2.0. <\/p>\n
O componente Rekor cont\u00e9m a implementa\u00e7\u00e3o de um log para armazenar metadados certificados com assinaturas digitais, que refletem informa\u00e7\u00f5es sobre os projetos. Para garantir a integridade e prote\u00e7\u00e3o contra a manipula\u00e7\u00e3o de dados retroativa, \u00e9 utilizada uma estrutura de \u00e1rvore chamada \"\u00e1rvore de Merkle\", na qual cada ramo verifica todos os ramos e n\u00f3s subjacentes por meio de hashing conjunto (em \u00e1rvore). Com um hash final, o usu\u00e1rio pode verificar a precis\u00e3o de todo o hist\u00f3rico de opera\u00e7\u00f5es, bem como a corre\u00e7\u00e3o dos estados passados do banco de dados (o hash de verifica\u00e7\u00e3o raiz do novo estado do banco de dados \u00e9 calculado levando em considera\u00e7\u00e3o o estado anterior). Um RESTful API, bem como uma interface de linha de comando, s\u00e3o fornecidos para verifica\u00e7\u00e3o e adi\u00e7\u00e3o de novos registros. <\/p>\n
O componente Fulcio (SigStore WebPKI) inclui um sistema para a cria\u00e7\u00e3o de autoridades certificadoras (root CA), que emitem certificados de curta dura\u00e7\u00e3o com base em e-mails autenticados via OpenID Connect. O tempo de vida do certificado \u00e9 de 20 minutos, durante os quais o desenvolvedor deve conseguir gerar uma assinatura digital (se posteriormente o certificado cair em m\u00e3os de um invasor, ele j\u00e1 estar\u00e1 expirado). Adicionalmente, o projeto desenvolve a ferramenta Cosign (Container Signing), destinada \u00e0 cria\u00e7\u00e3o de assinaturas para cont\u00eaineres, verifica\u00e7\u00e3o de assinaturas e publica\u00e7\u00e3o de cont\u00eaineres assinados em reposit\u00f3rios compat\u00edveis com OCI (Open Container Initiative). <\/p>\n
A implementa\u00e7\u00e3o do Sigstore permite aumentar a seguran\u00e7a dos canais de distribui\u00e7\u00e3o de software e se proteger contra ataques direcionados \u00e0 substitui\u00e7\u00e3o de bibliotecas e depend\u00eancias (supply chain). Um dos principais problemas de seguran\u00e7a em software livre \u00e9 a dificuldade de verificar a origem do software e a verifica\u00e7\u00e3o do processo de compila\u00e7\u00e3o. Por exemplo, para verificar a integridade de um lan\u00e7amento, a maioria dos projetos utiliza hashes, mas frequentemente as informa\u00e7\u00f5es necess\u00e1rias para a verifica\u00e7\u00e3o de autenticidade s\u00e3o armazenadas em sistemas n\u00e3o protegidos e em reposit\u00f3rios p\u00fablicos de c\u00f3digo, resultando na possibilidade de que invasores alterem os arquivos necess\u00e1rios para a verifica\u00e7\u00e3o e, sem levantar suspeitas, introduzam altera\u00e7\u00f5es maliciosas. <\/p>\n
O uso de assinaturas digitais para verifica\u00e7\u00e3o de lan\u00e7amentos ainda n\u00e3o se popularizou devido \u00e0s dificuldades na gest\u00e3o de chaves, distribui\u00e7\u00e3o de chaves p\u00fablicas e revoga\u00e7\u00e3o de chaves comprometidas. Para que a verifica\u00e7\u00e3o fa\u00e7a sentido, \u00e9 necess\u00e1rio tamb\u00e9m organizar um processo seguro e confi\u00e1vel de distribui\u00e7\u00e3o de chaves p\u00fablicas e checksums. Mesmo com a assinatura digital, muitos usu\u00e1rios ignoram a verifica\u00e7\u00e3o, pois precisam dedicar tempo para entender o processo de verifica\u00e7\u00e3o e descobrir qual chave merece confian\u00e7a. O projeto Sigstore busca simplificar e automatizar esses processos, oferecendo uma solu\u00e7\u00e3o pronta e testada. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439. Sigstore \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 (transparency log). \u041f\u0440\u043e\u0435\u043a\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u044d\u0433\u0438\u0434\u043e\u0439 \u043d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Google, Red Hat, Cisco, vmWare, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105382","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47An\u00fancio da prontid\u00e3o do sistema de verifica\u00e7\u00e3o criptogr\u00e1fica de c\u00f3digo Sigstore | ProHoster","description":"A Google anunciou a forma\u00e7\u00e3o das primeiras vers\u00f5es est\u00e1veis dos componentes que formam o projeto Sigstore, que foi declarado adequado para a cria\u00e7\u00e3o de implementa\u00e7\u00f5es operacionais.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u0433\u043e\u0442\u043e\u0432\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430 Sigstore | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-25T19:36:48+00:00","article:modified_time":"2022-10-25T19:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/105382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=105382"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/105382\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=105382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=105382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=105382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"