The news was released that on GitHub a proposal has been put up for discussion to implement the service Sigstore to verify packages with digital signatures and maintain a public record to confirm authenticity when distributing releases.
About the proposal it is mentioned that the use of Sigstore will allow to implement an additional level of protection against attacks aimed at replacing software components and dependencies (supply chain).
Securing the software supply chain is one of the biggest security challenges facing our industry right now. This proposal is an important next step, but truly solving this challenge will require commitment and investment from across the community…
These changes help protect open source consumers from software supply chain attacks; in other words, when malicious users attempt to spread malware by breaching a maintainer's account and adding malware to the open source dependencies used by many developers.
For example, the implemented change will protect project sources in case the developer account of one of the dependencies in NPM is compromised and an attacker generates a package update with malicious code.
It is worth mentioning that Sigstore is not just another code signing tool, as its normal approach is to eliminate the need to manage signing keys by issuing short-term keys based on OpenID Connect (OIDC) identities, at the same time as records the actions in an immutable ledger called rekor, in addition to which Sigstore has its own certification authority called Fulcio
Thanks to the new level of protection, developers will be able to link the generated package with the source code used and the build environment, giving the user the opportunity to verify that the contents of the package correspond to the contents of the sources in the main project repository.
The use of Sigstore greatly simplifies the key management process and eliminates the complexities associated with registration, revocation, and cryptographic key management. Sigstore promotes itself as Let's Encrypt for code, providing certificates for digitally signing code and tools to automate verification.
We're opening a new Request for Comments (RFC) today, which looks at binding a package to its source repository and build environment. When package maintainers opt for this system, consumers of their packages can have more confidence that the content of the package matches the content of the linked repository.
Instead of permanent keys, Sigstore uses short-lived ephemeral keys that are generated based on permissions. The material used for the signature is reflected in a modification-protected public record, allowing you to ensure that the author of the signature is exactly who they say they are, and the signature was formed by the same participant who was responsible.
The project has seen early adoption with other package manager ecosystems. With today's RFC, we propose to add support for end-to-end signing of npm packages using Sigstore. This process would include the generation of certifications about where, when and how the package was created, so that it can be verified later.
To ensure integrity and protection against data corruption, a Merkle Tree tree structure is used in which each branch checks all underlying branches and nodes via joint hash (tree). By having a trailing hash, the user can verify the correctness of the entire operation history, as well as the correctness of past database states (the root check hash of the new database state is calculated considering the past state).
Finally, it is worth mentioning that Sigstore is jointly developed by the Linux Foundation, Google, Red Hat, Purdue University, and Chainguard.
If you want to know more about it, you can consult the details in the following link.