Google yakazivisa kuumbwa kwekutanga kwakagadzikana kuburitswa kwezvikamu zvinoumba Sigstore purojekiti, iyo inonzi yakakodzera kugadzira kushanda kwekuita. Sigstore inogadzira maturusi nemasevhisi ekusimbisa software uchishandisa masiginecha edhijitari uye kuchengetedza ruzhinji log inosimbisa huchokwadi hwekuchinja (transparency log). Chirongwa ichi chiri kuvandudzwa pasi pehurongwa hwesangano risingabatsiri reLinux Foundation neGoogle, Red Hat, Cisco, vmWare, GitHub uye HP Enterprise nekupinda kwesangano reOpenSSF (Open Source Security Foundation) nePurdue University.
Sigstore inogona kufungidzirwa seanalogue ye Let's Encrypt yekodhi, ichipa zvitupa zvedhijitari kusaina kodhi uye maturusi e automating verification. NeSigstore, vanogadzira vanogona kusaina zvimisikidzo zvine chekuita nekushandisa senge mafaera ekuburitsa, mifananidzo yemidziyo, zviratidziro, uye zvinogoneka. Iyo siginecha yezvinyorwa inoratidzwa mune tamper-proof yeruzhinji log iyo inogona kushandiswa kuonesa nekuongorora.
Panzvimbo pemakiyi echigarire, Sigstore inoshandisa ephemeral makiyi enguva pfupi, ayo anogadzirwa zvichienderana nehunhu hwakasimbiswa neOpenID Connect vanopa (panguva yekugadzira makiyi anodiwa kugadzira siginecha yedhijitari, mugadziri anozvizivisa kuburikidza nemupi weOpenID akabatana ne email). Huchokwadi hwemakiyi hunosimbiswa pachishandiswa veruzhinji centralized log, izvo zvinoita kuti zvikwanisike kuona kuti munyori wechisiginicha ndiye waanozviti ndiye, uye siginicha yakagadzirwa nemutori wechikamu mumwechete aive nemhosva yekuburitswa kwakapfuura.
Kugadzirira kweSigstore kwekushandiswa kunokonzerwa nekuumbwa kwekuburitswa kwezvikamu zviviri zvakakosha - Rekor 1.0 uye Fulcio 1.0, iyo software interfaces iyo yakanzi yakagadzikana uye icharamba ichidzokera kumashure inoenderana. Izvo zvikamu zvesevhisi zvakanyorwa muGo uye zvakagoverwa pasi peApache 2.0 rezinesi.
Chikamu cheRekor chine dhizaini yekushandisa yekuchengetedza metadata yakasainwa inoratidza ruzivo nezve mapurojekiti. Kuve nechokwadi chekutendeseka uye kudzivirira kubva kuhuori hwe data mushure mechokwadi, chimiro cheMerkle Tree muti chinoshandiswa, umo bazi rega rega rinosimbisa matavi ese ari pasi nemanodhi kuburikidza nekubatana (muti) hashing. Kuve nehashi yekupedzisira, mushandisi anogona kuona kurongeka kwenhoroondo yese yekushanda, pamwe nekurongeka kwenzvimbo dzakapfuura dzedhatabase (iyo midzi yekuongorora hashi yemamiriro matsva edhatabhesi inoverengerwa uchifunga nezve mamiriro apfuura. ) A RESTful API inopihwa kuongororwa uye kuwedzera zvinyorwa zvitsva, pamwe neyekuraira mutsara interface.
Iyo Fulcio chikamu (SigStore WebPKI) inosanganisira sisitimu yekugadzira zvitupa zvitupa (midzi maCAs) inoburitsa zvitupa zvenguva pfupi zvinoenderana neemail yakasimbiswa kuburikidza neOpenID Connect. Hupenyu hwechitupa maminetsi makumi maviri, panguva iyo mugadziri anofanirwa kuve nenguva yekugadzira siginecha yedhijitari (kana chitupa chikazowira mumaoko eanorwisa, chinenge chatopera basa). Pamusoro pezvo, chirongwa ichi chiri kugadzira Cosign (Container Signing) turusi rekushandisa, rakagadzirirwa kugadzira masiginecha emidziyo, kuona masiginecha uye kuisa midziyo yakasainwa mumarepositori inoenderana neOCI (Open Container Initiative).
Kuitwa kweSigstore kunoita kuti zvikwanise kuwedzera kuchengetedzeka kwematanho ekugovera chirongwa uye kudzivirira kubva mukurwiswa kwakanangana nekutsiva maraibhurari uye zvinoenderana (supply chain). Imwe yematambudziko akakosha ekuchengetedza mune yakavhurika sosi software kuomerwa kwekuona kwakabva chirongwa uye kuona maitiro ekuvaka. Semuenzaniso, mapurojekiti mazhinji anoshandisa hashes kuratidza kutendeseka kwekuburitswa, asi kazhinji ruzivo rwunodiwa kuti ruvimbiswe rwunochengetwa pane asina kuchengetedzwa masisitimu uye mune yakagovaniswa kodhi repositori, semhedzisiro iyo vanorwisa vanogona kukanganisa mafaera anodiwa kuti aonekwe uye kuunza shanduko yakaipa. pasina kumutsa kufungirana.
Kushandiswa kwemasiginecha edhijitari yekusimbisa kuburitswa hakusati kwapararira nekuda kwekunetsa mukugadzirisa makiyi, kugovera makiyi eruzhinji, uye kudzoreredza makiyi akakanganisika. Kuti ongororo iite zvine musoro, zvakakoshawo kuronga nzira yakavimbika uye yakachengeteka yekugovera makiyi eruzhinji uye cheki. Kunyangwe iine siginecha yedhijitari, vashandisi vazhinji vanofuratira kusimbiswa nekuti ivo vanofanirwa kupedza nguva vachidzidza maitiro ekusimbisa uye kunzwisisa kuti ndeipi kiyi inovimbika. Iyo Sigstore purojekiti inoedza kurerutsa uye otomatiki maitiro aya nekupa yakagadzirira-yakagadzirwa uye yakaratidza mhinduro.
Source: opennet.ru