• Home
  • >
  • DevOps News
  • >
  • JFrog Platform ‘Crypto-Signs’ Binaries for Zero-Trust Software Lifecycle Management – InApps 2022

JFrog Platform ‘Crypto-Signs’ Binaries for Zero-Trust Software Lifecycle Management – InApps is an article under the topic Devops Many of you are most interested in today !! Today, let’s InApps.net learn JFrog Platform ‘Crypto-Signs’ Binaries for Zero-Trust Software Lifecycle Management – InApps in today’s post !

Read more about JFrog Platform ‘Crypto-Signs’ Binaries for Zero-Trust Software Lifecycle Management – InApps at Wikipedia



You can find content about JFrog Platform ‘Crypto-Signs’ Binaries for Zero-Trust Software Lifecycle Management – InApps from the Wikipedia website

The JFrog DevOps Platform is putting the blockchain to use, digitally signing the software binaries to document and secure their journeys through the entire development process.

JFrog‘s crypto-signing functionality may be the first commercial use of a blockchain technology to capture changes on a CI/CD platform, asserted JFrog founder and chief technology officer Yoav Landman. This update, and others unveiled at the company’s SwampUP user conference being held this week virtually, are part of the JFrog’s overall goal to give enterprises, and their developers, more efficient and secure ways to manage the software development lifecycle.

The management of software binaries — the actual application after its code has been compiled into an executable program — is a huge portion of this lifecycle management, Landman said in an interview with InApps.

“Developers like to think about code, but in reality, what’s happening is that the transition to binary is almost immediate,” Landman said. Even in accelerated DevOps schedules, binaries are needed to build against as dependencies. “The binary that will travel all the way to the runtime, through scanning, distribution, all the QA testing for different phases, all the way to production.”

Zero-Trust Pipelines

A software development pipeline is essentially a series of events to build an application and then move it to production. Each action can be captured in a log for record-keeping and accountability purposes. The crypto-signing augmentation of JFrog Pipelines workflow functionality automatically signs each step, and outcome, in the continuous integration and delivery (CI/CD) pipeline, in effect creating immutable a set of artifacts.  The platform uses a blockchain,  a cryptographically signed write-only ledger to provide proof of each pipeline action.

Read More:   One SRE’s Struggle and Success to Improve Infrastructure as Code – InApps 2022

This approach has an obvious security benefit in that only those binaries that have been signed at each step of the process can be moved into production.

It provides cryptographic “non-disputable proof that everything that happened in the background really happened,” Landman said. Every action is signed with a private key, which is then disposed, leaving only the corresponding public key to read the entry into the append-only log.  Each entry is formatted in JSON, which can be easy to read and program against.

“You have many steps in your pipeline for creating software, and for upgrading software. At the end of the day, you want to verify that what ends up in your runtime in your production is exactly the same thing that you initially built and packaged and compiled,” Landman said, pointing to the growing concern of securing the software development pipeline against attacks and malicious code.

As an example, a manager may have to approve through ServiceNow a software application being moved into production. This capability will capture that approval point in a tamper-proof way. It can also stop software drift, or minor configurations made by some developer that may in the short term be helpful, but ultimately moves the software away from the desired configuration.

Also in the Box

Other new features to the DevOps platform revealed include Cold Artifact Storage to archive software artifacts no longer actively needed but still required for regulatory requirements or corporate policies. A new security service, based on JFrog Xray, to scan open source third-party dependencies, will also be available later this year.

Read More:   Update A Tutorial Introduction to Google Vertex AI AutoML: Data Preparation

Also new for the platform are federation capabilities for the JFrog Artifactory, allowing organizations to build out multiple software repositories, synchronizing the contents across all of them. The new federated repository service offers automatic mirroring bi-directional synchronization of all binaries across separate instances of the JFrog DevOps Platform — the different “members” of the federation. In addition to the binaries, configuration and metadata can also be mirrored.

The JFrog DevOps platform is available both as a hosted service and as stand-alone software that can be run in-house.

JFrog is sponsoring our coverage of SwampUP, so check back here, and on our Twitter account,  for updates throughout the day, and in the week to come.

InApps is a wholly owned subsidiary of Insight Partners, an investor in the following companies mentioned in this article: JFrog.




Source: InApps.net

Rate this post
As a Senior Tech Enthusiast, I bring a decade of experience to the realm of tech writing, blending deep industry knowledge with a passion for storytelling. With expertise in software development to emerging tech trends like AI and IoT—my articles not only inform but also inspire. My journey in tech writing has been marked by a commitment to accuracy, clarity, and engaging storytelling, making me a trusted voice in the tech community.

Let’s create the next big thing together!

Coming together is a beginning. Keeping together is progress. Working together is success.

Let’s talk

Get a custom Proposal

Please fill in your information and your need to get a suitable solution.

    You need to enter your email to download

      Success. Downloading...