Software release verification

1. A method for sharing digital signature information of a software release, the method comprising:

receiving, by one or more processors, file information and multiple digital signatures from an entity device, each digital signature of the multiple digital signatures related to a corresponding development stage of multiple development stages of a software release;

receiving, by the one or more processors, a first public key and a second public key, where a first digital signature of the multiple digital signatures is generated using a first private key that corresponds to the first public key, and where a second digital signature of the multiple digital signatures is generated using a second private key that corresponds to the second public key;

generating, by the one or more processors, software release information comprising the multiple digital signatures and the file information; and

transmitting, by the one or more processors, the software release information and at least one of the first public key and the second public key to one or more node devices.

2. The method of claim 1 , further comprising initiating, by the one or more processors, transmission of digital signature metadata associated with the multiple digital signatures to the one or more node devices.

3. The method of claim 2 , where, for a particular digital signature of the multiple digital signatures, corresponding digital signature metadata indicates an author of the particular digital signature, a development stage corresponding to the particular digital signature, a time corresponding to generation of the particular digital signature, a build job number corresponding to the particular digital signature, a checksum corresponding to the particular digital signature, or any combination thereof.

4. The method of claim 2 , where the digital signature metadata enables, for a particular digital signature of the multiple digital signatures, identification of a public key that corresponds to a private key used to generate the particular digital signature.

5. The method of claim 2 , further comprising receiving, by the one or more processors, the digital signature metadata from the entity device.

6. The method of claim 2 , where a portion of the digital signature metadata that is associated with the first digital signature indicates an author of the first digital signature and a development stage of the multiple development stages that corresponds to the first digital signature.

7. The method of claim 2 , where a portion of the digital signature metadata that is associated with the first digital signature indicates a build job number corresponding to the first digital signature and a checksum corresponding to the multiple development stages that corresponds to the first digital signature.

8. The method of claim 2 , where a first portion of the digital signature metadata that is associated with the first digital signature enables identification of the first public key, and where a second portion of the digital signature metadata that is associated with the second digital signature enables identification of the second public key.

9. The method of claim 1 , further comprising:

receiving, by the one or more processors, multiple public keys corresponding to multiple private keys, where the multiple digital signatures are generated using the multiple private keys, where the multiple public keys include the first public key and the second public key, and where the multiple private keys include the first private key and the second private key; and

initiating, by the one or more processors, transmission of the multiple public keys to the one or more node devices.

10. The method of claim 1 , where:

the first private key comprises a first one-time use private key corresponding to a first development stage of the multiple development stages; and

the second private key comprises a second one-time use private key corresponding to a second development stage of the multiple development stages.

11. The method of claim 1 , where the software release information comprises a checksum for at least one of one or more files of the software release, a checksum for an entirety of the one or more files, or a combination thereof.

12. The method of claim 1 , further comprising receiving, by the one or more processors, the file information from the entity device.

13. A system for sharing digital signature information of a software release, the system comprising:

at least one memory storing instructions; and

one or more processors coupled to the at least one memory, the one or more processors configured to execute the instructions to cause the one or more processors to:

receive, from an entity device, file information and multiple digital signatures, each digital signature of the multiple digital signatures related to a corresponding development stage of multiple development stages of a software release;

receive a first public key and a second public key, where a first digital signature of the multiple digital signatures is generated using a first private key that corresponds to the first public key, and where a second digital signature of the multiple digital signatures is generated using a second private key that corresponds to the second public key;

generate software release information comprising the multiple digital signatures and the file information; and

transmitting the software release information and at least one of the first public key and the second public key to one or more node devices.

14. The system of claim 13 , where each digital signature of the multiple digital signatures corresponds to a software build job.

15. The system of claim 13 , where the one or more processors are further configured to maintain a ledger of digital signatures, the ledger including the multiple digital signatures and digital signature metadata corresponding to the multiple digital signatures.

16. The system of claim 13 , where the one or more processors are further configured to receive node information from the entity device, the node information corresponding to the one or more node devices.

17. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving, from an entity device, file information and multiple digital signatures, each digital signature of the multiple digital signatures related to a corresponding development stage of multiple development stages of a software release;

receiving a first public key and a second public key, where a first digital signature of the multiple digital signatures is generated using a first private key that corresponds to the first public key, and where a second digital signature of the multiple digital signatures is generated using a second private key that corresponds to the second public key;

generating software release information comprising the multiple digital signatures and the file information; and

transmitting the software release information and at least one of the first public key and the second public key to one or more node devices.

18. The non-transitory computer-readable medium of claim 17 , where the operations further comprise initiating transmission of digital signature metadata associated with the multiple digital signatures to the one or more node devices, where the digital signature metadata enables, for a particular digital signature of the multiple digital signatures, identification of a public key that corresponds to a private key used to generate the particular digital signature.

19. The non-transitory computer-readable medium of claim 17 , where the software release comprises one or more artifacts, and where receiving the multiple digital signatures comprises:

receiving a first digital signature corresponding to a first artifact of the one or more artifacts and corresponding to a first development stage of the multiple development stages; and

receiving a second digital signature corresponding to the first artifact and corresponding to a second development stage of the multiple development stages.

20. The non-transitory computer-readable medium of claim 19 , where receiving the multiple digital signatures further comprises:

receiving a third digital signature corresponding to a second artifact of the one or more artifacts and corresponding to the first development stage;

receiving a fourth digital signature corresponding to the second artifact and corresponding to the second development stage; and

receiving a fifth digital signature corresponding to the first artifact and the second artifact and corresponding to a third development stage of the multiple development stages.