Updates from The Update Framework
summary
The Update Framework provides cryptographic signing, multi-role delegations and expiry rules to give compromise resilience and freshness guarantees; a cleaned-up reference implementation 1.0 (Python) is production-ready and is used by Datadog and others, and Sigstore uses TUF to protect its CA and Rekor log. PyPI work runs in two stages: PEP 458/480 (458 signs repo metadata, 480 adds per-project namespaces and offline signing but raises UX and key-management issues). A prototypical repository playground and ephemeral OIDC-backed keys are under development.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:31Content Distribution
- 2:40Protect Content at Scale!!!
- 4:07Signing alone is not enough
- 5:04The Update Framework 101
- 6:15Delegate Trust at Scale
- 8:32Reduce Impact of Compromise
- 10:58The TUF Project
- 11:15Specification
- 12:14Reference Implementation
- 13:32More TUF
- 14:26TUF in Practice
- 19:57Plans for the Future
related talks
29mSecuring Content Distribution with The Update Framework (TUF)
22mSecuring Content Repositories with the Update Framework (TUF)
41mUsing TUF to Mitigate Repository Compromises
41mWhen The Going Gets Tough, Get TUF Going!
34mWhen the Going Gets Tough, Get TUF Going! [I]
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution
26mTUF-En Up Your Signatures
42mImproving Package Repository Security – From White Papers to Practice