Free digital signing service aims to bolster software supply chain security

The bulk of code in today’s modern software artifacts is open-source in origin. Still, the security controls around that code aren’t as sophisticated or widespread as they should be. For this reason, strong, verifiable signatures must be captured — these provide insight into components, their authors, and any potential tampering. 

“You wouldn’t bake a cake without a reasonable certainty that the ingredients you used were pure,” said Trevor Rosen, staff engineering manager and package security lead at GitHub. “But that’s basically what software authors using open-source without signatures are forced to do today: Use the ingredient and hope for the best.”

To support more widespread adoption of software signatures and further protect the software supply chain, the Sigstore community today announced at SigstoreCon the general availability of its free software signing service. 

The tool is designed to improve supply chain security by making it easy to sign, verify and check the software that developers are building and consuming. 

Signatures are “immensely useful” within a software supply chain, where code and artifacts are passed along a chain of systems, said Luke Hinds, founder of the project and security engineering lead at Red Hat in the office of the CTO.

“With digital signatures, we can ensure the software is tamper-free and have certainty on its source of origin,” he said.

Proper verification to avoid data breaches

Supply chain attacks now account for one-fifth of all data breaches, which are at an all-time high of $4.35 million. 

“Supply chain security issues are pervasive because the attack surface is vast, the payoff for success is huge, and the ecosystem has relatively few defenses today,” said Rosen. 

This is why it’s so important to digitally sign the various artifacts that comprise applications — from binaries and containers to aggregated files and software-bills-of-materials (SBOMs). Digital signatures help guarantee that a piece of software hasn’t been modified since signed, explained Priya Wadhwa, software engineer with Chainguard, a Sigstore sponsor. 

“They’re one of the first lines of defense in verifying the authenticity of a piece of software and a critical component of a secure software supply chain,” she said. 

Originally conceived and prototyped at Red Hat and now under the auspices of the Linux Foundation, the open-source Sigstore is intended to make cryptographic signing easier. 

“As evidenced by numerous supply chain attacks over the past several years, the software supply chain is unfortunately still vulnerable to tampering across several different threat vectors,”  said Bob Callaway, tech lead and manager at Google’s open-source security team. 

“When properly verified,” he said, “digital signatures provide the ability for consumers of software to make informed decisions about the provenance of artifacts and metadata.”

Eliminating cumbersome tooling process

Sigstore, which is actively maintained and scaled by more than 70 organizations, is becoming one of the fastest-adopted open-source technologies, logging more than 4 million signatures. 

It is used by individual developers and enterprise customers, and Kubernetes and Python — two of the world’s largest open-source communities — have adopted it. Most recently, the npm Registry — the center of JavaScript code sharing — announced that it is actively working to integrate Sigstore, so all npm packages can be linked to their source code and build instructions. 

Historically, the adoption of cryptographic signatures within open-source projects has been very low, largely due to the cumbersome tooling experience for developers, said Hinds. Callaway also described frustrating user experience and “onerous” key management as major barriers to adoption. 

With Sigstore, developers can sign software and consumers can verify it easily without managing signing keys, explained Wadhwa. It also provides non-repudiation and integrity assurance backed by strong cryptographic protocols. 

Sigstore leverages recent technology innovations around workload identity and certificate authority automation, signing is allowed with all traditional methods and “keyless” signing is provided — that is, just an email address is required. Sigstore is designed to work in popular CI/CD environments (GitHub Actions or Kubernetes), thus allowing developers to focus on writing software rather than signing and verifying it, said Wadhwa. 

With modular architecture and support across multiple popular programming languages, it is easy to integrate into existing and new software supply chains. 

The Sigstore community will operate the service with a 99.5% uptime SLO and round-the-clock pager support. 

The GA signals that, “important entities across industry and academia are joining forces to offer sustained solutions to one of the biggest threats to software security,” said Rosen. 

Stopping attacks before they wreak havoc

Sigstore adoption rate has “far exceeded” expectations and illustrates the need for a GA release of Sigstore’s APIs, said Hinds.

It’s so popular because it “gets the balance right” by providing a simple, easy-to-use developer experience coupled with strong security guarantees, he said. 

Wadhwa explained that the Sigstore community has worked all year to harden the service’s infrastructure, stabilize its APIs, perform an independent security audit and set up a 24/7 on-call rotation that is vendor-neutral. 

“By starting to secure the long tail of open-source software,” said Rosen, “Sigstore can be a vital part of a successful effort to stop these kinds of attacks before they have a chance to wreak havoc.”