Mukuedza kuchengetedza yemahara software yekupa cheni, iyo Linux Foundation (iyo isiri-purofiti sangano inokurudzira hunyanzvi kuburikidza neyakavhurwa sosi) yakabatana neRed Hat, Google, uye Purdue University kuvhura chirongwa chitsva chekubatsira vanogadzira nyore kutora cryptographic siginecha mune software.
Este chirongwa chitsva inotsigirwa nerekodhi yekuratidzira matekinoroji, sekuwedzera kuri kuita kwemaindasitiri kutorwa kweyakavhurika sosi software, chirongwa, Sigstore, ine chinangwa chekudzivirira kurwiswa kweveruzhinji software repository kubva kujekiseni kodhi yakashata muketani yekupa.
sigstore inobvumira vanogadzira software kusaina zvakachengeteka software yekugadzira senge vhezheni mafaira, mifananidzo yemidziyo, uye mabhainari. Izvo zvinotaurwa kuti zvakasainwa zvinhu zvinochengeterwa mune tamper-proof yeruzhinji runyorwa.
SigStore inotsvaga kugonesa vanogadzira kuti vanzwisise nekusimbisa mavambo uye chokwadi che software iyo yakavakirwa pane inowanzo kuve isina kusarudzika nzira uye mafomati edata. Mhinduro dziripo kazhinji dzinovakirwa pa "digests" (hash kana mhedzisiro yebasa rehash) yakachengetwa pasisitimu dzisina kuchengeteka, dzinogona kushatiswa uye kutungamira pakurwiswa kwakasiyana siyana, senge kuchinjaniswa kwehash kana basa rehash, kurwiswa kunoitirwa vashandisi.
Iko kushandiswa kwebasa ichave yakasununguka kune vese vanogadzira software uye vatengesi, uye nharaunda yeSigStore ichagadzira kodhi uye zvishandiso zvekushandisa sigstore. Red Hat, Google uye Purdue University ndevamwe vevatangi vechirongwa ichi.
"Sigstore inogonesa nharaunda dzese dzakasununguka kusaina software yavo uye inosanganisa provenance, kuvimbika uye kuwanikwa kuti vagadzire yakajeka uye inosimbiswa software yekutengesa," akadaro Luke Hinds, mukuru wezvekuchengetedza, hofisi yeRed Hat CTO. "Nekugamuchira kubatana uku kuLinux Foundation, tinogona kukurumidza basa redu pane sigstore uye nekutsigira kuenderera kugamuchirwa uye kukanganisa kweakavhurika sosi software nekuvandudza."
“Kuchengetedza mashandisirwo esoftware kunofanira kutanga nekuona kuti tiri kumhanyisa software yatinofunga kuti tinayo. sigstore inomiririra mukana wakanaka wekuunza kuvimba nekujeka kune yakavhurwa sosi software yekupa, "akadaro Josh Aas,
Kuitisana nharo kuti yazvino software yekupa cheni inoonekwa kune akawanda njodzi, chirongwa ichi chinoti izvo zviripo maturusi, izvo zvinosanganisira vanhu kusangana mumunhu kusaina makiyi, uye izvo zvakashanda zvakanaka kwenguva yakareba kudaro, haichagone kuwanikwa munzvimbo yanhasi nenzvimbo dzakapararira munzvimbo.
Zvakare, zvinotaurwa kuti kune mashoma akavhurwa sosi mapurojekiti ayo anonyora kusaina software vhezheni zvigadzirwa. Izvi zvinokonzerwa nechikamu chikuru kumatambudziko anochengetedzwa nesoftware mukutarisira kwakakosha, kukanganisa kukuru, kudzoserwa uye kugoverwa kwemakiyi eruzhinji uye zvigadzirwa zvehash. Izvi zvinoreva kuti vashandisi vanofanirwa kuona kuti ndeapi makiyi ekuvimba nawo uye vadzidze nhanho dzinodiwa kuti siginecha isainike.
“Sigstore ine tarisiro yekuita kuti vhezheni dzese dzevhurika sosi dzive nechokwadi uye kugonesa kuongorora nevashandisi. Ndinovimba tinogona kuita kuti izvi zvive nyore sekubuda kwevim, ”akadaro Dan Lorenc, injinjiniya pane Google yakavhurika sosi software yekuchengetedza.
Rimwe dambudziko nderekuti mahesheni nemakiyi eruzhinji anogoverwa sei: anowanzo chengetwa pamawebhusaiti anogona kubiwa kana mune iyo README faira iri mune yeruzhinji git repository.
SigStore inotsvaga kugadzirisa nyaya idzi nekushandisa mapfupi ephemeral makiyi ane mudzi wekutenda wakatorwa kubva kune yakavhurika uye inosimbiswa yeruzhinji pachena registry. Iyo sevhisi nyowani inobatsira vashanduri nevashandisi kuti vanzwisise nekusimbisa mavambo uye chokwadi che software, iine mashoma pamusoro.
“Ndiri kufara zvikuru nehurongwa hwakaita senge sigoreti. Iyo software ecosystem inoda nekukurumidza sisitimu yakadaro kuti iratidze nezve mamiriro echai cheni. Ini ndinofunga nesigstore, inopindura mibvunzo yese nezvezvinowanikwa pasoftware uye muridzi, tinogona kutanga kubvunza mibvunzo nezvezvinotorwa nesoftware, vatengi, kutevedza (zviri pamutemo uye neimwe nzira), kuti tione matsotsi ematsotsi uye tidzivirire zvivakwa zvepasoftware. ”, Akadaro Santiago Torres-Arias