Kompania Red Hat dhe Google, n\u00eb bashk\u00ebpunim me Universitetin Purdue, krijuan projektin Sigstore, i cili ka p\u00ebr q\u00ebllim zhvillimin e mjeteve dhe sh\u00ebrbimeve p\u00ebr verifikimin e softuerit duke p\u00ebrdorur n\u00ebnshkrime digjitale dhe duke mbajtur nj\u00eb regjist\u00ebr publik p\u00ebr t\u00eb konfirmuar autenticitetin (transparency log). Projekti do t\u00eb zhvillohet n\u00ebn ombrell\u00ebn e organizat\u00ebs jofitimprur\u00ebse Linux Foundation. <\/p>\n
Projekti i propozuar do t\u00eb rris\u00eb sigurin\u00eb e kanaleve t\u00eb shp\u00ebrndarjes s\u00eb softuerit dhe do t\u00eb mbroj\u00eb nga sulmet q\u00eb synojn\u00eb t\u00eb ndryshojn\u00eb komponent\u00ebt dhe var\u00ebsit\u00eb e softuerit (supply chain). Nj\u00eb nga problemet kryesore t\u00eb siguris\u00eb n\u00eb softuerin me burim t\u00eb hapur \u00ebsht\u00eb v\u00ebshtir\u00ebsia e verifikimit t\u00eb burimit t\u00eb softuerit dhe verifikimin e procesit t\u00eb nd\u00ebrtimit. P\u00ebr shembull, p\u00ebr t\u00eb verifikuar integritetin e nj\u00eb versioni, shumica e projekteve p\u00ebrdorin hash, por shpesh informacioni i nevojsh\u00ebm p\u00ebr verifikimin e autenticitetit ruhet n\u00eb sisteme t\u00eb pasigurta dhe n\u00eb depo t\u00eb p\u00ebrbashk\u00ebta me kod, duke rezultuar n\u00eb kompromitimin e t\u00eb cilave, agresor\u00ebt mund t\u00eb ndryshojn\u00eb skedar\u00ebt e nevojsh\u00ebm p\u00ebr verifikim dhe, pa shkaktuar dyshime, t\u00eb futin ndryshime t\u00eb d\u00ebmshme. <\/p>\n
Vet\u00ebm nj\u00eb pjes\u00eb e vog\u00ebl e projekteve p\u00ebrdorin n\u00ebnshkrime digjitale kur shp\u00ebrndajn\u00eb versionet p\u00ebr shkak t\u00eb v\u00ebshtir\u00ebsive n\u00eb menaxhimin e \u00e7el\u00ebsave, shp\u00ebrndarjen e \u00e7el\u00ebsave publik\u00eb dhe t\u00ebrheqjen e \u00e7el\u00ebsave t\u00eb komprometuar. P\u00ebr t\u00eb b\u00ebr\u00eb kuptim verifikimi gjithashtu k\u00ebrkohet t\u00eb organizohet nj\u00eb proces i besuesh\u00ebm dhe t\u00eb sigurt p\u00ebr shp\u00ebrndarjen e \u00e7el\u00ebsave publik\u00eb dhe hash-ave. Edhe kur ka n\u00ebnshkrim digjital, shum\u00eb p\u00ebrdorues e injorojn\u00eb verifikimin, pasi duhet t\u00eb kalojn\u00eb koh\u00eb n\u00eb studimin e procesit t\u00eb verifikimit dhe t\u00eb kuptojn\u00eb se cili \u00e7el\u00ebs meriton besim. <\/p>\n
Sigstore \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u0430\u043d\u0430\u043b\u043e\u0433 Let’s Encrypt \u0434\u043b\u044f \u043a\u043e\u0434\u0430, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c\u0438 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Sigstore \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0434\u043b\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438, \u043e\u0431\u0440\u0430\u0437\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043c\u0430\u043d\u0438\u0444\u0435\u0441\u0442\u044b \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b. \u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c\u044e Sigstore \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b \u043e\u0442\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u043c \u043e\u0442 \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u043b\u043e\u0433\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438 \u0430\u0443\u0434\u0438\u0442\u0430. <\/p>\n
N\u00eb vend t\u00eb \u00e7el\u00ebsave t\u00eb p\u00ebrhersh\u00ebm, Sigstore p\u00ebrdor \u00e7el\u00ebsa efemer t\u00eb shkurt\u00ebr t\u00eb jet\u00ebgjat\u00ebsis\u00eb, t\u00eb cil\u00ebt gjenerohen mbi baz\u00ebn e akteve t\u00eb verifikuara nga ofruesit OpenID Connect (n\u00eb momentin e gjenerimit t\u00eb \u00e7el\u00ebsave p\u00ebr n\u00ebnshkrimin e digjital, zhvilluesi identifikohet p\u00ebrmes ofruesit OpenID me lidhje me email-in). Autenticiteti i \u00e7el\u00ebsave verifikohet p\u00ebrmes nj\u00eb regjistri publik dhe t\u00eb centralizuar, i cili lejon t\u00eb sigurohet q\u00eb autori i n\u00ebnshkrimit \u00ebsht\u00eb v\u00ebrtet ai q\u00eb pretendon t\u00eb jet\u00eb dhe n\u00ebnshkrimi \u00ebsht\u00eb krijuar nga e nj\u00ebjta pal\u00eb q\u00eb ishte p\u00ebrgjegj\u00ebse p\u00ebr versionet e kaluara. <\/p>\n
Sigstore \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043a\u0430\u043a \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f, \u0442\u0430\u043a \u0438 \u043d\u0430\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043d\u0430 \u0441\u0432\u043e\u0451\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438. \u0421\u0435\u0440\u0432\u0438\u0441 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u0435\u043d \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u041f\u041e, \u0438 \u0440\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442 \u043d\u0430 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0435 — Linux Foundation. \u0412\u0441\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. <\/p>\n
Nga komponent\u00ebt n\u00eb zhvillim, mund t\u00eb p\u00ebrmenden: <\/p>\n