3 ms·

That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and too

That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and tooling to developers for free, but that tooling has limited value if the host OS doesn’t bundle the CA certificates that would enable native validation. [1]: https://www.sigstore.dev/ https://www.sigstore.dev/

uxp8u61q 3y ago
Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!
- woodruffw 3y ago
  There are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-suited for those contexts. With a self-signed certificate, you are effectively your own PKI. The goal is generally to deduplicate that kind of work while also providing better security properties than “my host trusts self-signed certificates from a root CA that I keep on disk somewhere.”
  - fragmede 3y ago
    Well the assumption is that the root CA stores them more safely than "on my laptop in my unlocked bedroom in an unassuming neighborhood of brighton" that most developers lean on for their secret storage, but, well, you never know.
  - snnn 3y ago
    A more specific example: nuget allows pinning the certs. https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#trustedsigners-section https://learn.microsoft.com/en-us/nuget/reference/nuget-conf... I feel signing a nuget package with a self-signed cert is not worse than any PGP signing method in term of trust level. They both are identified by a crypto fingerprint and you have to manually get the fingerprint from somewhere and just trust it. I do not see a big difference there.
- warent 3y ago
  The landing page linked above gives a pretty detailed write-up about the point of their service
layer8 3y ago
Sigstore doesn’t seem to verify actual legal identity, just control over a GitHub account or similar. It therefore doesn’t provide the same level of assurance as a code-signing certificate. OSs thus do well to not bundle their CA certificate as a trusted root.
- withinboredom 3y ago
  Github already provides a proxy of actual legal identity, at least in the EU. For a business owned org, the VAT id is provided along with validation and billing information must match.
- woodruffw 3y ago
  I don't think your OS intends to imply or guarantee a legal entity relationship with every CA certificate in your trust store. It's not even clear what that guarantee, as an end user, would get you: the presence of a legal entity doesn't somehow make that entity accountable to you or your locality.
  - TeMPOraL 3y ago
    > I don't think your OS intends to imply or guarantee a legal entity relationship with every CA certificate in your trust store. I get the feeling that it's exactly what Windows "intends to imply or guarantee", it's just taking a long time to get there. The whole code signing part is trying to create a reality where to be able to create software for Windows, you need to be a business entity, and need to have business relationships with Microsoft - directly, or transitively. Basically, a corporate web of trust.

uxp8u61q 3y ago

Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!

woodruffw 3y ago
There are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-suited for those contexts. With a self-signed certificate, you are effectively your own PKI. The goal is generally to deduplicate that kind of work while also providing better security properties than “my host trusts self-signed certificates from a root CA that I keep on disk somewhere.”
- fragmede 3y ago
  Well the assumption is that the root CA stores them more safely than "on my laptop in my unlocked bedroom in an unassuming neighborhood of brighton" that most developers lean on for their secret storage, but, well, you never know.
- snnn 3y ago
  A more specific example: nuget allows pinning the certs. https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#trustedsigners-section https://learn.microsoft.com/en-us/nuget/reference/nuget-conf... I feel signing a nuget package with a self-signed cert is not worse than any PGP signing method in term of trust level. They both are identified by a crypto fingerprint and you have to manually get the fingerprint from somewhere and just trust it. I do not see a big difference there.
warent 3y ago
The landing page linked above gives a pretty detailed write-up about the point of their service

layer8 3y ago

Sigstore doesn’t seem to verify actual legal identity, just control over a GitHub account or similar. It therefore doesn’t provide the same level of assurance as a code-signing certificate. OSs thus do well to not bundle their CA certificate as a trusted root.

withinboredom 3y ago
Github already provides a proxy of actual legal identity, at least in the EU. For a business owned org, the VAT id is provided along with validation and billing information must match.
woodruffw 3y ago
I don't think your OS intends to imply or guarantee a legal entity relationship with every CA certificate in your trust store. It's not even clear what that guarantee, as an end user, would get you: the presence of a legal entity doesn't somehow make that entity accountable to you or your locality.
- TeMPOraL 3y ago
  > I don't think your OS intends to imply or guarantee a legal entity relationship with every CA certificate in your trust store. I get the feeling that it's exactly what Windows "intends to imply or guarantee", it's just taking a long time to get there. The whole code signing part is trying to create a reality where to be able to create software for Windows, you need to be a business entity, and need to have business relationships with Microsoft - directly, or transitively. Basically, a corporate web of trust.