TUF Maintainer Panel Discussion
summary
TUF has working implementations in python, go, rust and is already used by organizations like Datadog, AWS BottleRocket, Google Fuchsia and Sigstore; the automotive variant Uptane is standardized and deployed in cars and introduces multi-repository consensus to compare metadata from independent repos. The project ships features for offline and online keys, but repository-side deployments remain the hardest part (a PyPI-style repo effort stretches nine years), CVEs tend to appear in the python reference implementation, and interoperability and secure developer-signing are current priorities.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:35Introductions
- 2:20Andrew Krug
- 19:46Software Repository
- 25:41Top Project
- 28:21Cross Compatibility
- 31:43Continuous Improvement
- 33:40Whats Next
related talks
26mTUF-En Up Your Signatures
29mSecuring Content Distribution with The Update Framework (TUF)
41mUsing TUF to Mitigate Repository Compromises
29mTUF-en up Your Software Supply Chain
27mUpdates from The Update Framework
34mWhen the Going Gets Tough, Get TUF Going! [I]
22mSecuring Content Repositories with the Update Framework (TUF)
36mTUF / Notary Project Intro