{"id":103534,"date":"2022-03-14T15:36:53","date_gmt":"2022-03-14T13:36:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij"},"modified":"2022-03-14T15:36:53","modified_gmt":"2022-03-14T13:36:55","slug":"dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","title":{"rendered":"TUF 1.0 este disponibil, un cadru pentru organizarea livr\u0103rii sigure a actualiz\u0103rilor","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A fost publicat\u0103 versiunea 1.0 a framework-ului TUF (The Update Framework), care ofer\u0103 instrumente pentru verificarea sigur\u0103 a disponibilit\u0103\u021bii \u0219i desc\u0103rc\u0103rii actualiz\u0103rilor. Obiectivul principal al proiectului este de a proteja clientul \u00eempotriva atacurilor standard asupra repositoarelor \u0219i infrastructurii, inclusiv \u00eempotriva promov\u0103rii de c\u0103tre r\u0103u-voitori a actualiz\u0103rilor false, create dup\u0103 ce au ob\u021binut acces la cheile pentru generarea semn\u0103turilor digitale sau compromiterea repositoarelor. Proiectul se dezvolt\u0103 sub egida organiza\u021biei Linux Foundation \u0219i este utilizat pentru a \u00eembun\u0103t\u0103\u021bi securitatea livr\u0103rii actualiz\u0103rilor \u00een proiecte precum Docker, Fuchsia, Automotive Grade Linux, Bottlerocket \u0219i PyPI (includerea verific\u0103rii desc\u0103rc\u0103rilor \u0219i metadatelor \u00een PyPI este a\u0219teptat\u0103 \u00een cur\u00e2nd). Codul de referin\u021b\u0103 al implement\u0103rii TUF este scris \u00een Python \u0219i este distribuit sub licen\u021ba Apache 2.0. <\/p>\n

Proiectul dezvolt\u0103 o serie de biblioteci, formate de fi\u0219iere \u0219i utilitare, care pot fi integrate u\u0219or \u00een sistemele existente de actualizare a aplica\u021biilor, oferind protec\u021bie \u00een caz de compromitere a cheilor pe partea dezvoltatorilor de software. Pentru a utiliza TUF, este suficient s\u0103 ad\u0103uga\u021bi \u00een repositar metadatele necesare, iar \u00een codul client s\u0103 integra\u021bi procedurile oferite \u00een TUF pentru desc\u0103rcarea \u0219i verificarea fi\u0219ierelor. <\/p>\n

Framework-ul TUF se ocup\u0103 cu sarcinile de verificare a disponibilit\u0103\u021bii actualiz\u0103rilor, desc\u0103rcarea actualiz\u0103rilor \u0219i verificarea integrit\u0103\u021bii acestora. Sistemul de instalare a actualiz\u0103rilor nu se intersecteaz\u0103 direct cu metadatele suplimentare, a c\u0103ror verificare \u0219i desc\u0103rcare sunt gestionate de TUF. Pentru integrarea cu aplica\u021biile \u0219i sistemele de instalare a actualiz\u0103rilor, este oferit un API de nivel sc\u0103zut pentru accesul la metadate \u0219i implementarea unui API client de nivel \u00eenalt, ngclient, gata pentru a fi integrat \u00een aplica\u021bii. <\/p>\n

Printre atacurile la care TUF poate r\u0103spunde se num\u0103r\u0103 substituirea versiunilor vechi sub forma actualiz\u0103rilor pentru a bloca remedierile vulnerabilit\u0103\u021bilor din software sau revenirea utilizatorului la o versiune veche vulnerabil\u0103, precum \u0219i promovarea actualiz\u0103rilor mali\u021bioase, semnate corect cu o cheie compromis\u0103, realizarea atacurilor DoS asupra clien\u021bilor, cum ar fi umplerea discului cu actualiz\u0103ri infinite. <\/p>\n

Protec\u021bia \u00eempotriva compromiterii infrastructurii furnizorului de software se realizeaz\u0103 prin men\u021binerea unor \u00eenregistr\u0103ri separate \u0219i verificabile ale st\u0103rii repositoarelor sau aplica\u021biilor. Metadatele TUF verificabile includ informa\u021bii despre cheile de care se poate avea \u00eencredere, hash-uri criptografice pentru evaluarea integrit\u0103\u021bii fi\u0219ierelor, semn\u0103turi digitale suplimentare pentru certificarea metadatelor, detalii despre numerele de versiune \u0219i date despre durata de via\u021b\u0103 a \u00eenregistr\u0103rilor. Cheile utilizate pentru verificare au o durat\u0103 de via\u021b\u0103 limitat\u0103 \u0219i necesit\u0103 actualiz\u0103ri constante pentru a se proteja \u00eempotriva semn\u0103rii cu chei vechi. <\/p>\n

Reducerea riscului de compromitere a \u00eentregului sistem se realizeaz\u0103 prin utilizarea unui model de separare a \u00eencrederii, \u00een care fiecare parte este limitat\u0103 doar la domeniul pe care \u00eel gestioneaz\u0103 direct. Sistemul folose\u0219te o ierarhie de roluri cu propriile sale chei; de exemplu, rolul r\u0103d\u0103cin\u0103 semneaz\u0103 cheile pentru rolurile responsabile de metadatele din repository, informa\u021biile despre momentul \u00een care au fost create actualiz\u0103rile \u0219i versiunile \u021bint\u0103; la r\u00e2ndul s\u0103u, rolul care se ocup\u0103 de construc\u021bii semneaz\u0103 rolurile legate de certificarea fi\u0219ierelor livrate.

\"TUF<\/center> <\/p>\n

Pentru a proteja \u00eempotriva compromiterii cheilor, se utilizeaz\u0103 un mecanism de revocare \u0219i \u00eenlocuire a cheilor. Fiecare cheie con\u021bine doar puterile minime necesare, iar pentru opera\u021biunile de certificare este necesar\u0103 utilizarea mai multor chei (scurgerea unei chei individuale nu permite atacarea imediat\u0103 a clientului, iar pentru compromiterea \u00eentregului sistem este nevoie de capturarea cheilor tuturor participan\u021bilor). Clientul poate accepta doar fi\u0219iere create ulterior fa\u021b\u0103 de cele deja primite, iar datele sunt \u00eenc\u0103rcate doar conform dimensiunii stabilite \u00een metadatele certificate. <\/p>\n

Lansarea publicat\u0103 TUF 1.0.0 propune o implementare de referin\u021b\u0103 complet rescris\u0103 \u0219i stabilizat\u0103 a specifica\u021biei TUF, care poate fi utilizat\u0103 ca exemplu gata f\u0103cut pentru crearea propriilor implement\u0103ri sau pentru integrarea \u00een proiectele proprii. Noua implementare con\u021bine semnificativ mai pu\u021bin cod (1400 de linii \u00een loc de 4700), este mai u\u0219or de \u00eentre\u021binut \u0219i poate fi extins\u0103 cu u\u0219urin\u021b\u0103, de exemplu, atunci c\u00e2nd este necesar\u0103 ad\u0103ugarea suportului pentru stive de re\u021bea specifice, sisteme de stocare sau algoritmi de criptare.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 TUF 1.0 (The Update Framework), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0437\u0430\u0449\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043e\u0442 \u0442\u0438\u043f\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0438\u043b\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f. \u041f\u0440\u043e\u0435\u043a\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u044d\u0433\u0438\u0434\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Disponibil TUF 1.0, cadrul pentru organizarea livr\u0103rii sigure a actualiz\u0103rilor | ProHoster","description":"A fost publicat cadrul TUF 1.0 (The Update Framework), care ofer\u0103 instrumente pentru verificarea sigur\u0103 a disponibilit\u0103\u021bii \u0219i desc\u0103rc\u0103rii actualiz\u0103rilor.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d TUF 1.0, \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 TUF 1.0 (The Update Framework), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/dostupen-tuf-1-0-frejmvork-dlya-organizaczii-bezopasnoj-dostavki-obnovlenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-14T13:36:55+00:00","article:modified_time":"2022-03-14T13:36:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103534","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-14 13:37:57","updated":"2022-09-29 02:42:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103534","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103534"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103534\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/103535"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}