Package-Transparency-for-Wasm-Registries.pdf

1、Package Transparency forWebAssembly RegistriesKyle Brown,SingleStoreOverviewIntroduce WebAssembly(Wasm)What is a Package Registry?Applying Certificate Transparency to Package RegistriesPackage Transparency&wargPackage Transparency vs.Various AttacksWebAssembly(Wasm)WebAssembly(Wasm)isA platform-agno

2、stic“compile target”orsomething you can compile programs to.Well-supportedWork is in progress for many more languagesIt became a W3C Standard in 2019Wasm was created as a web technologyHistorysupported by major browsers since 2017Wasm isnt just for the webWasm has really valuable propertiesPortabili

3、tySpeedLow startup latencyNear-native performanceSecurityCapability safetySandboxing&memory isolationPeople using Wasm outside the browserDatabase ExtensibilityEdge ComputingServerlessDistributed AppsWasm applications and libraries will becomposed,shared,and deployedWasm needs a nativepackage regist

4、ryWe need a registry as secure as Wasm itselfYou wouldnt seal a vaultwith a CheetoWhat is a Package Registry?RegistryPackage Registries RolePackage Registries RoleRegistryPackageOwnersDelegate names toRegistryPackageOwnersReleasesDelegate names toPublishversionedPackage Registries RoleA Registry is

5、an Index(name,version)package digestRegistries must control metadataPackage NameReleasesfoo0.1.0=sha256:deadbeef,bar1.2.0=sha256:beefdead,RegistryRegistries may delegate content hostingPackage NameReleasesfoo0.1.0=sha256:deadbeef,bar1.2.0=sha256:beefdead,Self-HostedStoreCDNOCIRegistry3rd-PartyConten

6、tMirrorsRegistryHow can we applyCertificate Transparency toPackage Registries?People are able to detect when CAs misissue certificatesClients should be able to detect when registries accept invalidpackage updatesPackage Transparency“Package transparency is publishing cryptographically-verifiable com