CodeNotary

codenotary

The combination of our free, lightning-fast and always-on timestamp service and the easy to use cli tool, gets you started in a minute. Everything is built on top of open source components. Every build has a story to tell - Tamperproof provenance for your code and CI/CD pipeline What is trusted timestamping? is the process of securely keeping track of the creation and modification time of a document. Trusted timestamping Security here means that no one—not even the owner of the document—should be able to change it once it has been recorded provided that the timestamper's integrity is never compromised. uses its immutable open source database to provide this service that includes cryptographic verification and immutable data history. CodeNotary immudb CodeNotary Use Cases This timestamping service provides full immutability for all data ever written and unique data checksum ever stored including its history. As a trust level comes with the timestamp, you can change your mind over time (unsupport, untrust) without touching the code or binary. As the complete trust and timestamping history is stored for any digital identity (SHA-256 checksum), you can easily create workflows and decision trees in your CI/CD recipes. There are plenty of different use cases: Add a trusted timestamp to code Add an immutable timestamp to electronic signatures Seal the data integrity and your trust level at a given point in time Prove the existence of elecronic data at a specific point in time CI/CD integration - notarize all outgoing assets, authenticate all incoming Store provenance for you own sources Unsupport deprecated versions of your software and run update checks bases on the latest timestamp Revoke trust (untrust) at any time without the need to touch your code or binaries Trust or remove trust for digital assets and act on the status (within your script or pipeline) Simply timestamp files and sources to doublecheck at any time in the future if these are still the same (backup/restore) Simply request your API key and get started within a minute! This service was built using Open Source and to run free forever! Notarized assets information is stored in a tamperproof ledger with cryptographic verification backed by immudb, the immutable database. Obtain an API Key To provide access to our timestamping service a valid API Key is required. If you don't have one yet, simply signup here . CodeNotary Timestamp This API Key is bound to your email address and it's required during vcn login. Quick start 1. In case you use Linux or macOS, the quickest start is our install script: Installer bash <(curl https: //getvcn.codenotary.com -L) You can also download the latest release 2. to Login timestamp.codenotary.com vcn login --lc-host timestamp.codenotary.com # type your API key when requested
# or setting the API key
VCN_LC_API_KEY= in < Your-API-Key vcn login --lc-host timestamp.codenotary.com 3. Once you have an account you can start notarizing digital assets to give them an identity. Notarize (Timestamp) existing digital objects vcn n <file|dir: //directory|docker://dockerimage|git://gitdirectory> 4. You can use the command as a starting point. Authenticate digital objects vcn a <file|dir: //directory|docker://dockerimage|git://gitdirectory> : the timestamping and verification calculates a SHA256, so larger files might take a bit longer depending on your system. Tip For detailed , just run . command line usage vcn help Also published at https://dev.to/vchaindz/codenotary-free-trusted-timestamping-service-for-developer-158f

CodeNotary provides a Free Open Source Timestamping Service for Developers

167 Stories To Learn About Developer Tools

is for systems and applications. immudb lightweight, high-speed immutable database With you can track changes in sensitive data in your transactional databases and then record those changes indelibly in a the tamperproof immudb database. immudb This allows you to keep an indelible history of, say, your debit/credit transactions. immudb is open source under the , and can be found here (there is also a more comprehensive documentation): Apache v2.0 License https://github.com/codenotary/immudb Traditional transaction logs are hard to scale, and are not immutable. So there is no way to know for sure if your data has been compromised. You can find an example video here: https://www.youtube.com/watch?v=g7msV9NcwNA&t=1s How it works As such immudb provides , of what happened to your sensitive data, even if your perimiter was compromised. immudb provides the guarantatee of immutability by using internally a . unparalleled insights retro-actively Merkle tree structure immudb gives you the same of the integrity of data written with like classic blockchain without the cost and complexity associated with blockchains today. cyrptographic verification SHA-256 immudb has 4 main benefits: . You can only add records, but . immudb is immutable never change or delete records data stored in immudb is , like blockchains, just without all the complexity and at high speed. cryptographically coherent and verifiable Anyone can get . Wether in node.js, Java, Python, Golang, .Net, or any other language. It’s very easy to use and you can have your immutable database running in just a few minutes. started with immudb in minutes Finally, immudb is . You can run it , or in the and it’s completely free. immudb is governed by the Apache 2.0 License. Open Source on-premises cloud immudb runs on , , , and , among other systems derived from them, such as and . Linux FreeBSD Windows MacOS Kubernetes Docker Getting started You can either build Docker images based on the Dockerfiles in the GitHub repository for the most common architectures or use the prebuild ones on Dockerhub for Linux. immudb Dockerhub docker run -it -d -p 3322:3322 -p 9497:9497 — name immudb codenotary/immudb:latest standalone Binaries If you want to build the yourself, simply and run one of the following commands based on your operating system. binaries clone this repo GOOS=linux GOARCH=amd64 make immudb-static GOOS=darwin GOARCH=amd64 makeimmudb-static GOOS=windows GOARCH=amd64 make immudb-static # Linux # macOS # Microsoft Windows Then you can run immudb the immudb server ./immudb ./immudb -d # run immudb in the foreground # run immudb in the background install immudb as a service ./immudb service immudb install ./immudb service immudb status ./immudb service immudb stop ./immudb service immudb start # install immudb service # check current immudb service status # stop immudb service # start immudb service The immud linux service is using the following defaults: user: immu group: immu configuration: /etc/immudb data: /var/lib/immudb logs: /var/log/immudb Service Port: 3322 (immudb) Prometheus Exporter Port: 9497 Performance As immudb is often compared to Amazon QLDB, we did a performance benchmark using a simple demo application to write data (without using any unfair optimization). Test setup: 4 CPU cores Intel(R) Xeon(R) CPU E3–1275 v6 @ 3.80GHz 64 GB memory SSD Prometheus and Grafana monitoring immudb has a built-in prometheus exporter that publishes all metrics at port 9497 (:9497/metrics) by default. When running a Prometheus instance, you can configure the target like in this example: - job_name: 'immudbmetrics' scrape_interval: 60 s static_configs: - targets: ['my-immudb-server:9497'] There is a Grafana dashboard available as well: https://grafana.com/grafana/dashboards/12026 Common Use Cases We already learned about the following use cases from users: use immudb to immutably store every update to sensitive database fields (credit card or bank account data) of an existing application database store CI/CD recipes in immudb to protect build and deployment pipelines store public certificates in immudb use immudb as an additional hash storage for digital objects checksums store log streams (i. e. audit logs) tamperproof No programmer? Actually in case you’re not a programmer but still want to use immudb just to play around or within scripts, you can use immuclient. GOOS=linux GOARCH=amd64 make immuclient-static GOOS=windows GOARCH=amd64 make immuclient-static # Linux # Microsoft Windows In case you have no idea how to build it, you can use the following Docker command and procedurel: git clone https://github.com/codenotary/immudb.git docker run -it --rm -v $( ):/src golang:1.13-stretch sh -c docker run -it --rm -v $( ):/src golang:1.13-stretch sh -c # Linux pwd 'cd /src && GOOS=linux GOARCH=amd64 make immuclient-static' # Microsoft Windows pwd 'cd /src && GOOS=windows GOARCH=amd64 make immuclient-static' Now you’ll find the immuclient binary in the repository folder and ready to be used. gives you details how to use it. ./immuclient --help Add a record to immudb ./immuclient safeset mykey myvalue ./immuclient -a <immudb-ip> safeset mykey myvalue # same system where immudb server is running # immudb server runs on a remote system You'll receive something similar to: ./immuclient safeset k1 v1
index: 307
key: k1
value: v1 : 4a6a18172eba5a3ea49a3caf147ac405c874ed4c922cc7dafe0dce5ff85f35aa
time: 2020–05–13 04:01:30 -0400 EDT
verified: hash true Get the record from immudb ./immuclient safeget mykey ./immuclient mykey ./immuclient -a <immudb-ip> safeget mykey # same system where immudb server is running # get the value history history # immudb server runs on a remote system The and commands do a consistency check for the values as well. safeGet safeSet Now you could store any kind of data, like the content of a sensitive database field, public certificate or a even a configuration file. Let’s try with a local Dockerfile and make sure there are not new lines or special characters in our value. ./immuclient safeset Dockerfile1 $( -n | base64 -w 0) echo " " $(cat Dockerfile) To get the data back, you need to make sure to convert it again. As the output of safeget contains more than just the value, as seen here: ./immuclient safeget Dockerfile1
index:          309
key:            Dockerfile1
value:          RlJPTSBnb2xhbmc6MS4xMy1zdHJldGNoIGFzIGJ1aWxkCldPUktESVIgL3NyYwpDT1BZIC4gLgpSVU4gR09PUz1saW51eCBHT0FSQ0g9YW1kNjQgbWFrZSBpbW11YWRtaW4tc3RhdGljCkZST00gdWJ1bnR1OjE4LjA0Ck1BSU5UQUlORVIgdkNoYWluLCBJbmMuICA8aW5mb0B2Y2hhaW4udXM+CgpDT1BZIC0tZnJvbT1idWlsZCAvc3JjL2ltbXVhZG1pbiAvdXNyL2xvY2FsL2Jpbi9pbW11YWRtaW4KCkFSRyBJTU1VX1VJRD0iMzMyMiIKQVJHIElNTVVfR0lEPSIzMzIyIgoKRU5WIElNTVVBRE1JTl9JTU1VREItQUREUkVTUz0iMTI3LjAuMC4xIiBcCiAgICBJTU1VQURNSU5fSU1NVURCLVBPUlQ9IjMzMjIiIFwKICAgIElNTVVEQl9NVExTPSJmYWxzZSIgCgpSVU4gYWRkZ3JvdXAgLS1zeXN0ZW0gLS1naWQgJElNTVVfR0lEIGltbXUgJiYgXAogICAgYWRkdXNlciAtLXN5c3RlbSAtLXVpZCAkSU1NVV9VSUQgLS1uby1jcmVhdGUtaG9tZSAtLWluZ3JvdXAgaW1tdSBpbW11ICYmIFwKICAgIGNobW9kICt4IC91c3IvbG9jYWwvYmluL2ltbXVhZG1pbgoKVVNFUiBpbW11CkVOVFJZUE9JTlQgWyIvdXNyL2xvY2FsL2Jpbi9pbW11YWRtaW4iXQ== :           dfca217e2d87dccb8fd3fe8c1b49e620cc4ece8dc9c9fc2384cb6f6c9617eddb
time:           2020-05-13 05:19:19 -0400 EDT
verified: hash true the command is a bit more complex ./immuclient safeget Dockerfile1 | grep | cut -d -f2 | xargs -n | base64 -di "^value" ":" echo immudb SDKs There are many options for developers using the SDKs for Go Java, Node.js, Python These can be found in a developer jumpstart guide: https://docs.immudb.io/master/jumpstart.html#contents and the API descriptions: https://docs.immudb.io/master/sdks-api.html There is also a great Go SDK video tutorial: https://www.youtube.com/watch?v=qCC_AghFiw4 Check out immudb, the immutable database, written in Go: https://github.com/codenotary/immudb

A Step by Step Guide to immudb — the open source immutable database

I still remember February 2018 very well. Many people were in a really bad mood when it came to Blockchain or Distributed Ledger Technology (DLT), mainly because the price of most cryptocurrencies made a nose dive and the Disillusionment started. Funny enough, that was also the time, when my co-founder Moshe Bar (he became famous as the co-founder of XenSource and Qumranet) had some very interesting discussions how we can solve a real big DevOps-related issue. We wanted to give digital objects a globally unique and meaningful identity without changing or appending something. Achieving Integrity and Trust for any digital asset. If you want to see our projects (free for open source and non-commercial projects) before reading the full story: Github: vcn CodeNotary command line Github: CodeNotary Kubernetes integration CodeNotary website Some background So far, people either thought about checksum for files, source code or container images and best-case to use digital certificates to sign these files (if the file type was supported). While the checksum calculation using sha256 or sha512 is great for the digital fingerprint, digital certificates are not really made to use for any digital asset you can find. Last but not least, digital certificates are definitely not made for the agile world. Quick one - what happens if you revoke a digital certificate: all digital objects signed using this digital certificate are revoked depending on the OS, Application or execution engine, warnings are shown for objects with revoked signatures sometimes, binaries with revoked signatures can't be opened anymore But more important, when do you revoke a certificate? you lost the private key someone stole your private key you don't trust an digital asset anymore you signed And here comes the real issue - if you would start signing hundreds or thousands of digital assets, you don't want to revoke your certificate just because of one or two you don't trust anymore. That also means, most certificates will never be revoked even if they are lost, stolen or untrusted. To sign a digital object that has a revoked certificate with a new valid certificate you need to have access to it and redistribute it. Not just a huge effort - its sometimes impossible. Another reason why revocation is more of a nice idea than a powerful action to regain trust. That makes digital certificates unfit for the solution we were about to build. Here comes the Blockchain In 2018 most people looked the other way when it came to Blockchain (mainly because of the price drop in Cryptocurrencies). We figured, that Blockchain was exactly the technology we needed to achieve our goal of global digital asset identity and trust - without becoming part of the "shady" . certificate authority industry We moved ahead, founded , assembled a team and starting coding from day 1. vChain, Inc. Distributed Ledger Technology When digging into DLT, you quickly realize that many parts are still experimental and the existing tooling is in its early days. Leveraging public blockchains has some major disadvantages, high latency and the use of volatile crypto-currencies are just 2 of them. Our requirements: no crypto-currency or tokens: As we expected loads of digital assets being written to the Blockchain, no-fee transactions were a absolute must no private Blockchain: We didn't want to go into a private Blockchain direction either, as our data required to be public accessible by just connecting to the Blockchain itself no hosted Blockchain: the last thing we wanted was a lock-in from day one and blockchain data migration ... well, long story available talent and tooling: going to exotic also means that developer are much harder to find and most tooling needs to be developed as well always on: from the start Long story short: we decided to go for a consortium blockchain based on Ethereum ( Parity Ethereum ) Zero Trust Consortium Of course you need to start somewhere, so we set up our testnet internally without a consortium, to play around, research the required smart contracts and create the initial architecture. We also approached different companies to start the consortium with - to run a Blockchain for the software industry, by the software industry. To our surprise our Consortium Blockchain idea was of great interest for many companies and in January 2019 we had already set up the Zero Trust Consortium with the Mainnet distributed across 12 initial members that run their own Parity Ethereum nodes. 9 months later, we just crossed the 30 member count. The Zero Trust Consortium (ZTC) is headquartered in Switzerland with off-chain governance in place for new members and runs its own operations, independently from any member. Zero Downtime, No Hardforks, Fully managed. Every software company is welcome to join, run a node or become a contributing member. Let's get back to DevOps and some basics As the foundation for our solution was covered with the ZTC platform, we could completely focus on developing the solution to be released as . CodeNotary When speaking about DevOps, basically a ton of topics are put into that bucket. Procedures, tools, automation, build pipelines, handling and storage of source code, microservices, container, ... the list can go on forever. But the most important parts from a digital asset perspective are: Source Code (code repositories) artifacts (CI/CD, automation) files (configuration, definition, description, documentation) container (images, layer) Our goal from the beginning was to support all of these, without touching them and without disrupting the automation in any way. Of course the integration should be easy to use, easy to integrate and fit for the modern age. We named the process of creating a digital asset identity with a user identity and the process of integrity and trust level verification . notarization authentication Of course before something can the authenticated it needs to be notarized by someone on the platform. CodeNotary Process of CodeNotary notarization calculating a sha256 checksum getting files or object attributes writing the object checksum to the Ethereum-technology-based blockchain including the trust level using the user identity (private key) adding object attributes on a blockchain-protected relational database (CodeNotary backend) success is only returned, when all data has successfully been written to the Blockchain This example shows the notarization of a Prometheus configuration file, but it can be any artefact, a github repo, a docker image or a local directory. If you want to either unsupport (i. e. because a newer version has been released and you want to unsupport the older versions) or untrust (in case you found a flaw, issue or just don't like the object anymore). That way the status on the Blockchain changes as well and can immediately be checked from anywhere in the world. I'll get into that later. vcn unsupport prometheus.yml vcn untrust prometheus.yml Let's also publicly notarize a very common docker container image: docker pull ubuntu vcn n -p docker://ubuntu:latest Important - unlike digital code signing the digital asset is never changed or touched Process of CodeNotary authentication While Notarization is the most important part to get digital assets notarized with the unique identity, a trust level given by the signing user, its important to know that anyone in the world is now able to authenticate the very same digital asset. calculating a sha256 checksum querying the object checksum on the Ethereum-technology-based blockchain (either in general, only for a certain user or if a member of a given organization) Success: You get the digital asset trust level and metadata back Unknown: the digital asset has not been notarized yet Important: No data except the unique checksum is ever uploaded. It not just saves bandwidth, it provides privacy as well. Coming back to the notarized prometheus.yaml file, there are a couple of ways how you can authenticate. Using the vcn command line: vcn a prometheus.yaml Remember the last notarization action was to unsupport the file, therefore we get an error as well. The error is especially helpful, when you integrate vcn into any automation or script. Authenticating the docker image vcn a docker://ubuntu:latest But there are more ways to authenticate notarized objects: CodeNotary website: https://authenticate.codenotary.io Google Chrome extension Javascript: https://github.com/vchain-us/jsvcn Maven: https://github.com/vchain-us/jvcn-maven-plugin Kubernetes: https://github.com/vchain-us/kube-notary Btw. we're currently working on a full blown API, so it gets even easier to integrate. Dashboard Whatever you do, it can be checked on the Dashboard. If you provide and maintain non-commercial Open Source  projects, you get all features for free. CodeNotary Full transparency on the Blockchain Don't just take our word for it. You can check the Blockchain yourself following this video: https://vimeo.com/361498314 Blockchain Explorer: https://explore.zerotrustconsortium.org CodeNotary Smart Contract Decoder: o https://decode.codenotary.i Quick install Get started within a few minutes. When you are on a command line, you can simply download the vcn CodeNotary version and start using it. https://github.com/vchain-us/vcn/releases/latest more documentation is on the GitHub Readme of the vcn project: https://github.com/vchain-us/vcn

Stories, News & Mentions about CODENOTARY

Codenotary’s Stories on HackerNoon