{"id":115675,"date":"2024-05-10T19:52:06","date_gmt":"2024-05-10T17:52:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-gittuf-razvivaet-sistemu-kriptograficheskoj-zashhity-repozitoriev-git"},"modified":"2024-05-10T19:52:06","modified_gmt":"2024-05-10T17:52:06","slug":"proekt-gittuf-razvivaet-sistemu-kriptograficheskoj-zashhity-repozitoriev-git","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/proekt-gittuf-razvivaet-sistemu-kriptograficheskoj-zashhity-repozitoriev-git","title":{"rendered":"Projektet gittuf utvecklar en kryptografisk skyddssystem f\u00f6r Git-repositorier","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Gittuf version 0.4 is now available, developing a hierarchical system for verifying the content of Git repositories, allowing for the minimization of risks in situations where individual developers with access to the repository are compromised. Gittuf provides an additional layer of security to Git and a set of utilities for managing the keys of all developers with access to the repository, as well as setting access rules for branches, tags, and individual files. The project is written in Go and distributed under the Apache 2.0 license. The project is in an active development phase and is at alpha release quality, suitable for experimentation but not yet ready for production deployments. <\/p>\n
Information and artifacts providing additional verification of changes made are stored in a Git object storage in a specific namespace for gittuf, which allows retaining backward compatibility with existing tools and services, including GitHub and GitLab. When using tools that do not support gittuf, the repository remains fully accessible, but the ability for advanced integrity verification is limited. The architecture of gittuf is based on proven elements of the TUF (The Update Framework), which is used to protect the update generation processes in projects like Docker, Fuchsia, AGL (Automotive Grade Linux), and PyPI. <\/p>\n
The verification model in gittuf is based on a hierarchical system of trust distribution. The root of trust belongs to the repository owner, who can generate keys for development participants and define the rules under which the created keys may be used. Gittuf allows for the creation of flexible, granular rules that define the powers of each developer and the area of the repository they are authorized to modify. For example, a developer may be authorized to create tags, modify specific branches, or change only individual files in the repository. <\/p>\n
Utvecklare och de \u00e4ndringar de g\u00f6r identifieras med nycklar och digitala signaturer. Gittuf m\u00f6jligg\u00f6r att generera nya nycklar, s\u00e4kert distribuera nycklar, utf\u00f6ra regelbunden rotation av nycklar, \u00e5terkalla komprometterade nycklar, hantera \u00e5tkomstlistor (ACL) och namnrymder i Git-repositorier. Gittuf h\u00e5ller ocks\u00e5 ett referenslogg \u00f6ver alla f\u00f6r\u00e4ndringar (RSL - Referensstatlogg), vars integritet och skydd mot efterhandsmanipulation s\u00e4kerst\u00e4lls genom en tr\u00e4dstruktur kallad \"Merkle-tr\u00e4d\". Varje gren verifierar alla underliggande grenar och noder tack vare tr\u00e4dhashning (med en slutlig hash kan anv\u00e4ndaren bekr\u00e4fta korrektheten av hela operationens historia samt tidigare tillst\u00e5nd). <\/p>\n
F\u00f6r att verifiera digitala signaturer av commits och tags skapar och distribuerar \u00e4garen av repositoryn offentliga nycklar som \u00e4r direkt associerade med repositoryt. F\u00f6r att motverka att angripare fr\u00e4mjar \u00e4ndringar skapade efter att ha f\u00e5tt \u00e5tkomst till nycklar f\u00f6r att skapa digitala signaturer f\u00f6r enskilda utvecklare, till\u00e4mpas mekanismer f\u00f6r \u00e5terkallelse och byte av nycklar. Nycklarna har en begr\u00e4nsad livsl\u00e4ngd och kr\u00e4ver st\u00e4ndig uppdatering f\u00f6r att skydda mot signerande av gamla nycklar. \n K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"