Sigstore, kev pabcuam dawb los xyuas cov keeb kwm thiab tseeb ntawm software

Nyob rau hauv kev rau siab mus ruaj ntseg cov dawb software mov saw, lub Linux Foundation (lub koom haum non-profit uas xa kev txhim kho kev txhim kho los ntawm qhib lub peev xwm) tau koom tes nrog Red Hat, Google, thiab Purdue University los tsim ua ib qhov project tshiab los pab cov neeg tsim khoom siv tau yooj yim lees txais kev kos npe cryptographic hauv software.

Este tshiab qhov project tau txais kev txhawb los ntawm cov ntaub ntawv pob tshab thev naus laus zis, raws li qhov kev lag luam ua kev nce qib ntawm cov qhib qhov software, cov phiaj xwm, Sigstore, muaj lub hom phiaj los tiv thaiv qhov kev tawm tsam ntawm lub chaw software pej xeem los ntawm kev txhaj cov teeb meem tsis ncaj rau hauv cov saw mov.

sigstore yuav cia cov software tsim tawm kos npe rau kev nyab xeeb software artifacts xws li cov ntaub ntawv hloov kho, cov thawv ntim, thiab binaries. Nws tau hais tias cov khoom kos npe tau muab khaws cia rau hauv phau ntawv xov xwm pej xeem hauv phau ntawv pov thawj.

SigStore nrhiav kev txhim kho cov neeg tsim khoom kom nkag siab thiab paub meej qhov keeb kwm thiab tseeb ntawm cov software uas ua raws li cov kev teeb tsa sib luag thiab cov qauv ntaub ntawv. Cov kev daws teeb meem uas muaj nyob feem ntau yog los ntawm "sau ntawv" (hash lossis qhov txiaj ntsig ntawm hash muaj nuj nqi) khaws cia rau hauv cov kab kev tsis ruaj ntseg, uas tuaj yeem ua rau muaj kev cuam tshuam thiab ua rau muaj ntau yam kev tawm tsam, xws li hash pauv lossis hash muaj nuj nqi, tawm tsam cov neeg siv.

Kev siv ntawm kev pabcuam yuav pub dawb rau tag nrho cov software tsim thiab cov neeg muag khoom, thiab SigStore zej zog yuav tsim cov cai thiab cov cuab yeej ua haujlwm rau cov sigstore. Red Hat, Google thiab Purdue University yog nyob hauv cov koom tes nrhiav neeg ntawm txoj haujlwm.

"Sigstore ua rau txhua qhov chaw qhib cov zej zog tuaj yeem kos npe rau lawv cov software thiab muab cov khoom pov thawj, kev ncaj ncees thiab kev pom zoo los tsim cov pob tshab thiab cov ntaub ntawv pov thawj muaj txiaj ntsig ntawm cov khoom xa khoom," Luk Hinds, tus thawj saib xyuas kev ruaj ntseg, Red Hat CTO chaw haujlwm. "Los ntawm kev koom tes nrog kev koom tes ntawm Linux Foundation, peb tuaj yeem nrawm peb txoj haujlwm ntawm cov sigstore thiab txhawb kev txuas ntxiv txais yuav thiab cuam tshuam ntawm qhib software thiab kev txhim kho."

"Kev ua kom cov software tsim nyog yuav tsum pib nrog kev ua kom paub tseeb tias peb tau khiav lub software uas peb xav tias peb muaj. sigstore sawv cev rau lub sijhawm zoo los ua kom muaj kev ntseeg siab ntau dua thiab qhib siab qhib lub lag luam qhib cov khoom lag luam xa tuaj, "Josh Aas,

Kev sib cav hais tias niaj hnub no software muab saw yog raug rau ntau yam txaus ntshai, qhov project hais tias cov cuab yeej uas twb muaj lawm, uas koom nrog cov neeg sib tham hauv tus neeg los kos npe cov yuam sij, thiab uas tau ua haujlwm zoo tau ntev, tsis tuaj yeem ua tiav hauv ib puag ncig niaj hnub no nrog thaj chaw huab cua tawg.

Tsis tas li, nws yog hais tias muaj heev ob peb qhib qhov project uas cryptographically kos npe software version artifacts. Qhov no feem ntau vim yog cov teeb meem software tswj tau ntsib hauv kev tswj hwm qhov tseem ceeb, kev cuam tshuam tseem ceeb, thim rov qab thiab faib ntawm cov yuam sij rau pej xeem thiab cov khoom cuav. Qhov no txhais tau tias cov neeg siv yuav tsum txheeb xyuas cov yuam sij twg los cia siab thiab kawm cov kauj ruam uas yuav tsum muaj thiaj siv tau kev kos npe.

“Sigstore hom phiaj los ua kom tag nrho cov qauv ntawm qhib qhov software xyuas tau thiab los pab cov pov thawj los ntawm cov neeg siv. Vam tias peb tuaj yeem ua qhov no yooj yim thaum tawm ntawm kev tawm, "Dan Lorenc, software engineer ntawm Google qhov qhib software software pab pawg. 

Lwm qhov teeb meem yog qhov hashes thiab cov yuam sij rau pej xeem tau faib: lawv feem ntau khaws cia rau hauv cov vev xaib uas tau txais hacked lossis nyob rau hauv README cov ntaub ntawv nyob hauv lub chaw tso tawm git.

SigStore nrhiav kev daws qhov teeb meem no los ntawm kev siv lub sijhawm luv luv ntawm cov yuam sij uas muaj lub hauv paus ntawm kev ntseeg siab los ntawm kev qhib npe thiab pov thawj rau pej xeem cov ntawv teev meej. Qhov kev pabcuam tshiab yuav pab cov tsim kev tsim tawm thiab cov neeg siv nkag siab thiab paub meej cov keeb kwm thiab qhabnias ntawm lub software, nrog lub luag haujlwm me me.

“Kuv zoo siab heev uas muaj cov kab ke zoo li sigstore. Lub software ecosystem ceev nrawm xav tau cov kab ke no los tshaj tawm cov xwm txheej ntawm cov xov tooj sib txuas. Kuv xav nrog sigstore, uas teb tag nrho cov lus nug txog software chaw thiab muaj tswv, peb tuaj yeem pib nug cov lus txog software chaw, neeg siv khoom, kev ua raws cai (kev cai lij choj thiab lwm yam), txhawm rau txheeb xyuas cov kev ua txhaum cai lij choj thiab muaj kev ruaj ntseg software tseem ceeb. ", Santiago Torres-Arias hais.

 


Cov ntsiab lus ntawm tsab xov xwm ua raws li peb cov ntsiab cai ntawm kev tswj hwm kev ncaj nceesCov. Tshaj tawm ib qho yuam kev nyem no.

Yog thawj tus tuaj tawm tswv yim

Tso koj saib

Koj email chaw nyob yuav tsis tsum luam tawm.

*

*

  1. Lub luag haujlwm rau cov ntaub ntawv: Miguel Ángel Gatón
  2. Lub hom phiaj ntawm cov ntaub ntawv: Tswj SPAM, kev tswj xyuas tawm tswv yim.
  3. Sau raws cai: Koj kev tso cai
  4. Kev sib txuas lus ntawm cov ntaub ntawv: Cov ntaub ntawv yuav tsis raug xa mus rau lwm tus neeg thib peb tsuas yog los ntawm kev txiav txim siab raug cai.
  5. Cov ntaub ntawv khaws cia: Cov Ntaub Ntawv khaws tseg los ntawm Occentus Networks (EU)
  6. Txoj Cai: Txhua lub sijhawm koj tuaj yeem txwv, rov qab thiab tshem tawm koj cov ntaub ntawv.

bool (muaj tseeb)