Granted Patent B2

US 12,289,415 · App. 18/414,903 · Granted Apr 29, 2025

Inventor: Yoav Landman (Netanya, IL)

Assignee: JFrog Ltd.

H04L9/3247G06F8/60

Abstract

Claims (53)

1. A method for verification of a deployed software release, the method comprising:

receiving, by one or more processors, software release information and multiple digital signatures corresponding to different development stages of multiple development stages of a software release, the software release information comprising an indication of one or more files;

receiving, by the one or more processors, a first public key, a second public key, or both, the first public key associated with a first private key used to generate a first digital signature of the multiple digital signatures, and the second public key associated with a second private key used to generate a second digital signature of the multiple digital signatures;

identifying, by the one or more processors, the one or more files based on the indication;

verifying, by the one or more processors, the multiple digital signatures based on the first public key, the second public key, or both; and

processing, by the one or more processors, the one or more files based on verification of the multiple digital signatures.

2. The method of claim 1 , further comprising:

receiving, by the one or more processors, digital signature metadata associated with the multiple digital signatures.

3. The method of claim 2 , where, for a particular digital signature of the multiple digital signatures, the digital signature metadata indicates an author of the particular digital signature, a development stage corresponding to the particular digital signature, a time corresponding to generation of the particular digital signature, a build job number corresponding to the particular digital signature, a checksum corresponding to the particular digital signature, or any combination thereof.

4. The method of claim 2 , where:

the first public key corresponds to a first author; and

the digital signature metadata indicates that the first digital signature corresponds to the first author.

5. The method of claim 1 , where:

the software release comprises one or more artifacts;

the first digital signature corresponds to a first artifact of the one or more artifacts and to a first development stage of the multiple development stages; and

the second digital signature corresponds to the first artifact and to a second development stage of the multiple development stages.

6. The method of claim 1 , where:

the software release comprises one or more artifacts;

the first digital signature corresponds to a first artifact of the one or more artifacts and to a first development stage of the multiple development stages; and

the second digital signature corresponds to a second artifact of the one or more artifacts and to the first development stage.

7. The method of claim 1 , where processing the one or more files comprises:

loading, by the one or more processors, the one or more files to a memory responsive to verifying that the one or more files have completed the multiple development stages; and

setting, by the one or more processors, a flag corresponding to the one or more files to indicate that the one or more files have completed the multiple development stages.

8. The method of claim 7 , where processing the one or more files further comprises:

executing, by the one or more processors, the one or more files; and

initiating, by the one or more processors, transmission of a notification indicating that the one or more files are accepted.

9. The method of claim 1 , where processing the one or more files comprises discarding, by the one or more processors, the one or more files responsive to a failure to verify that the one or more files have completed the multiple development stages.

10. The method of claim 9 , further comprising initiating, by the one or more processors, transmission of a notification indicating that the one or more files are rejected.

11. A system for verification of a deployed software release, the system comprising:

at least one memory storing instructions; and

one or more processors coupled to the at least one memory, the one or more processors configured to execute the instructions to cause the one or more processors to:

receive software release information and multiple digital signatures corresponding to different development stages of multiple development stages of a software release, the software release information comprising an indication of one or more files;

receive a first public key, a second public key, or both, the first public key associated with a first private key used to generate a first digital signature of the multiple digital signatures, and the second public key associated with a second private key used to generate a second digital signature of the multiple digital signatures;

identify the one or more files based on the indication;

verify the multiple digital signatures based on the first public key, the second public key, or both; and

process the one or more files based on verification of the multiple digital signatures.

12. The system of claim 11 , where:

the software release comprises one or more artifacts;

the first digital signature corresponds to a first artifact of the one or more artifacts and to a first development stage of the multiple development stages;

the second digital signature corresponds to a second artifact of the one or more artifacts and to a second development stage of the multiple development stages; and

a third digital signature of the multiple digital signatures corresponds to the first artifact and the second artifact and to a third development stage of the multiple development stages.

13. The system of claim 12 , where:

a fourth digital signature of the multiple digital signatures corresponds to the first artifact and to the second development stage; and

a fifth digital signature of the multiple digital signatures corresponds to the second artifact and to the first development stage.

14. The system of claim 11 , where the one or more processors are further configured to receive, for each digital signature of the multiple digital signatures, corresponding digital signature metadata.

15. The system of claim 14 , where, for a particular digital signature of the multiple digital signatures, the corresponding digital signature metadata indicates an author of the particular digital signature, a development stage corresponding to the particular digital signature, a time corresponding to generation of the particular digital signature, a build job number corresponding to the particular digital signature, a checksum corresponding to the particular digital signature, or any combination thereof.

16. The system of claim 14 , where a portion of the digital signature metadata that is associated with the first digital signature indicates an author of the first digital signature and a development stage of the multiple development stages that corresponds to the first digital signature.

17. The system of claim 14 , where a portion of the digital signature metadata that is associated with the first digital signature indicates a build job number corresponding to the first digital signature and a checksum corresponding to the multiple development stages that corresponds to the first digital signature.

18. The system of claim 14 , where a first portion of the digital signature metadata that is associated with the first digital signature enables identification of the first public key, and where a second portion of the digital signature metadata that is associated with the second digital signature enables identification of the second public key.

19. The system of claim 11 , where:

the first private key comprises a first one-time use private key corresponding to a first development stage of the multiple development stages; and

the second private key comprises a second one-time use private key corresponding to a second development stage of the multiple development stages.

20. The system of claim 11 , where the indication of the one or more files included in the software release information comprises a checksum for at least one of the one or more files, a checksum for the entirety of the one or more files, or a combination thereof.

Assignments (1)

Continuity (5)

References Cited (212)