Decentralized attestations for software artifacts
Embodiments describe techniques for validating the integrity and compliance of software artifacts through the use of attestations. An attestation manager is capable of retrieving an attestation file from storage, validating the software artifact and the attestation chain within the attestation, and optionally generate new attestations to add to the attestation chain when the software artifact and the attestation chain have been validated. A public-key encryption scheme may be applied to validate attestations while a fingerprint comparison scheme may be applied to validate the software artifact.
1 . A method, comprising:
retrieving an attestation file from storage, the attestation file including a first attestation that attests a software artifact satisfies a first property, the first attestation including a first cryptographic fingerprint associated with the software artifact and a first cryptographic signature;
validating the software artifact, wherein validating the software artifact includes:
applying a cryptographic algorithm on the software artifact to generate a second cryptographic fingerprint; and
comparing the first cryptographic fingerprint and the second cryptographic fingerprint;
validating contents of the first attestation, wherein validating the contents of the first attestation includes applying a first public-key to the contents of the first attestation other than the first cryptographic signature stored within the first attestation to generate a second cryptographic signature and comparing the first cryptographic signature and the second cryptographic signature; and
in response to successfully validating the contents of the first attestation and validating the software artifact, generating a second attestation that the software artifact satisfies a second property and adding the second attestation to the attestation file.
2 . The method as in claim 1 , wherein the software artifact is validated when the first cryptographic fingerprint and the second cryptographic fingerprint are the same.
3 . The method as in claim 1 , wherein the first property is one of a functional requirement, business requirement, and compliance requirement of the software artifact.
4 . The method as in claim 1 , wherein the first cryptographic signature was previously generated by applying a first private key that corresponds with the first public-key to the contents of the first attestation other than the first cryptographic signature.
5 . The method as in claim 1 , wherein the first attestation further includes the first public-key.
6 . The method as in claim 1 , wherein the first attestation further includes metadata describing the first attestation.
7 . The method as in claim 6 , wherein the metadata includes a name of a first attestor and a first attestation type.
8 . The method as in claim 1 , wherein the first attestation further includes metadata describing the software artifact.
9 . The method as in claim 1 , wherein generating the second attestation includes:
receiving metadata describing the second attestation;
generating a second cryptographic signature based on the metadata and the software artifact; and
writing the metadata, the second cryptographic signature, and the first cryptographic fingerprint in the second attestation.
10 . A system comprising:
one or more processors;
a non-transitory computer-readable medium storing a program executable by the one or more processors, the program comprising sets of instructions for:
retrieving an attestation file from storage, the attestation file including a first attestation that attests a software artifact satisfies a first property, the first attestation including a first cryptographic fingerprint associated with the software artifact and a first cryptographic signature;
validating the software artifact, wherein validating the software artifact includes:
applying a cryptographic algorithm on the software artifact to generate a second cryptographic fingerprint; and
comparing the first cryptographic fingerprint and the second cryptographic fingerprint;
validating contents of the first attestation, wherein validating the contents of the first attestation includes applying a first public-key to the contents of the first attestation other than the first cryptographic signature stored within the first attestation to generate a second cryptographic signature and comparing the first cryptographic signature and the second cryptographic signature; and
in response to successfully validating the contents of the first attestation and validating the software artifact, generating a second attestation that the software artifact satisfies a second property and adding the second attestation to the attestation file.
11 . The system of claim 10 , wherein the software artifact is validated when the first cryptographic fingerprint and the second cryptographic fingerprint are the same.
12 . The system of claim 10 , wherein the first cryptographic signature was previously generated by applying a first private key that corresponds with the first public-key to the contents of the first attestation other than the first cryptographic signature.
13 . The system of claim 10 , wherein the first attestation further includes the first public-key.
14 . A non-transitory computer-readable medium storing a program executable by one or more processors, the program comprising sets of instructions for:
retrieving an attestation file from storage, the attestation file including a first attestation that attests a software artifact satisfies a first property, the first attestation including a first cryptographic fingerprint associated with the software artifact and a first cryptographic signature;
validating the software artifact, wherein validating the software artifact includes:
applying a cryptographic algorithm on the software artifact to generate a second cryptographic fingerprint; and
comparing the first cryptographic fingerprint and the second cryptographic fingerprint;
validating contents of the first attestation, wherein validating the contents of the first attestation includes applying a first public-key to the contents of the first attestation other than the first cryptographic signature stored within the first attestation to generate a second cryptographic signature and comparing the first cryptographic signature and the second cryptographic signature; and
in response to successfully validating the contents of the first attestation and validating the software artifact, generating a second attestation that the software artifact satisfies a second property and adding the second attestation to the attestation file.
15 . The non-transitory computer-readable medium of claim 14 , wherein the software artifact is validated when the first cryptographic fingerprint and the second cryptographic fingerprint are the same.