GitHub is Guarding Open Source Against Supply Chain Attacks

A string of additional software supply chain attacks continues to emphasize the urgent need to secure software chains of custody in the wake of the 2020 SolarWinds cyberespionage campaign, in which Russian hackers introduced tainted updates into a widely used IT management platform. The problem is even more pressing in open source, where projects are by definition ad hoc and decentralized. This week, the company announced a strategy to provide enhanced protections for open-source security in response to a series of alarming breaches of widely downloaded JavaScript software packages from the well-known "npm" registry, which is owned by GitHub.

Microsoft-owned GitHub announced on Monday that it will use the code-signing platform Sigstore to support code signing, also known as a digital wax seal, for npm software packages. The goal of the cross-industry collaboration that led to the creation of the tool was to make it much simpler for open-source maintainers to verify that the code they produce is identical to the code that is actually found in the software packages that are downloaded by people all over the world.

According to Justin Hutchings, the director of product management at GitHub, "While most npm packages are open source, there’s currently no guarantee that a package on npm is built from the same source code that’s published."Adding signed build information to open-source packages that validate where the software came from and how it was built is a great way to reduce the attack surface because supply chain attacks are on the rise.

To put it another way, it all comes down to creating a transparent and cryptographically verified telephone game.

Dan Lorenc, CEO of Chainguard, a company that collaborated on the development of Sigstore, emphasizes that, despite the fact that GitHub is not the sole component of the open-source ecosystem, it is an essential community hub because it is where the majority of projects store and publish their source code. However, developers typically use a package manager when they actually want to download open-source software or tools.

“Since you don't install the source code directly, you usually install a compiled version of it, which means that something happened between the source code and the package's creation. And up until this point, that entire step in open source has been a mystery,” Lorenc explains. You look at the code and then download the package. However, there is no evidence that the package came from that code or that the same person was involved, so GitHub is fixing that."

The Sigstore tools assist developers in managing cryptographic checks and requirements as software moves through the supply chain. By providing Sigstore to package managers, there is significantly more transparency at every stage of the software's journey. According to Lorenc, many individuals are shocked to learn that these integrity checks are not already in place and that a significant portion of the open-source ecosystem has relied on blind trust for such a considerable amount of time. An executive order that specifically addressed software supply chain security was issued by the Biden White House in May 2021.

"Didn't we already have this?" people ask."The majority of people either don't believe you or are scared because of that gap between the code and the package," says Lorenc.

The Linux Foundation, Google, Red Hat, Purdue University, and Chainguard all contributed to the development of Sigstore. There is an official tool for signing Python package distributions using Sigstore, and the open-source software development platform Kubernetes now supports Sigstore.

According to GitHub's Hutchings, "traditional methods of managing signing keys just don't scale well to the sheer size of the open source community and don't give insight into how the software was built."We like that Sigstore doesn't require any configuration on the part of end users. As a result, we can scale this up with our developer ecosystem regardless of where the source code is located.

Similar to the huge industry effort to promote HTTPS web encryption, which was made possible in large part by tools like Let's Encrypt from the non-profit Internet Security Research Group, Sigstore relies on being free and simple to use to get people to use it.According to Github, the project will begin with a proposal for Sigstore's npm implementation and an open comment period to solicit community feedback on the tool's precise deployment. However, the ultimate objective is to make supply chain attacks much more difficult by introducing code signing to as many open source software as possible.

According to GitHub's Hutchings, "We want to see a world where eventually all software artifacts are signed and linked back to the source code."Building on an open technology stack like Sigstore, which other packaging repositories can also adopt, is crucial because of this.