Automatic signature method and system for software packet in version control system

Abstract

The invention relates to an automatic signature method for a software packet in a version control system, and an automatic signature system for the software packet. Through the adoption of the automatic signature method, the automatic signature is realized through the construction of an automatic signature system; the automatic signature system mainly comprises a version control system and a signature service system; the signature service system mainly comprises a signature service client, a signature transit server, and a signature server; the signature service client is deployed in the middle of the server of the version control system by default, and the software packet is automatically triggered to sign in the version control system and the software packet is saved; the signature loop can be reduced while manufacturing the published version, plenty of time is saved, and the version publishing speed is accelerated. Through the construction of the signature service system, the software packet signature environment is independent, and a signature key of the published version is managed through a key database, thereby simplifying the signature operation and reducing manual intervention; the possibility of misoperation is eliminated while the automatic signature is realized.

Description

technical field [0001] The invention relates to a method and system for signing a software package. Background technique [0002] In order to prove that the software is indeed released by the software developer, software signature is a widely used method. Software developers digitally sign the software they publish, and users can use the code signing service to identify the publisher of the software and whether the software has been tampered with during transmission. Software developers can use the forgery resistance of code signatures to establish certain credibility for their trademarks and products. [0003] Linux distributors usually use GPG to sign released software packages. Users can verify the signature of software packages to ensure the validity and legitimacy of the software package sources and prevent malicious tampering. When creating a signed software package, the private key of the key pair is used to sign, and then the public key is published. After the soft...

AI Technical Summary

Problems solved by technology

To simplify the production process of the operating system release version to reduce the cost of distribution, and solve the problem that because some permissions of the version control server are open to the outside world, it is easy to be maliciously invaded, and the signature is stolen to sign the illegal software package.

Images