Home

Awesome

GitHub Workflow Status (with branch) codecov Go Reference Go Report Card License

<img src="https://cdn.rawgit.com/theupdateframework/artwork/3a649fa6/tuf-logo.svg" height="100" valign="middle" alt="TUF"/> go-tuf/v2 - Framework for Securing Software Update Systems


The Update Framework (TUF) is a framework for secure content delivery and updates. It protects against various types of supply chain attacks and provides resilience to compromise.

About The Update Framework


The Update Framework (TUF) design helps developers maintain the security of a software update system, even against attackers that compromise the repository or signing keys. TUF provides a flexible specification defining functionality that developers can use in any software update system or re-implement to fit their needs.

TUF is hosted by the Linux Foundation as part of the Cloud Native Computing Foundation (CNCF) and its design is used in production by various tech companies and open-source organizations.

Please see TUF's website for more information about TUF!

Overview


The go-tuf v2 project provides a lightweight library with the following functionality:

Examples


There are several examples that can act as a guideline on how to use the library and its features. Some of which are:

To try it - run make example-repository (the artifacts will be located at examples/repository/).

To try it - run make example-client (the artifacts will be located at examples/client/)

To try it - run make example-tuf-client-cli

To try it - run make example-multirepo

Package details


The metadata package

The trustedmetadata package

The config package

The fetcher package

The updater package

The multirepo package

Documentation


History - legacy go-tuf vs go-tuf/v2

The legacy go-tuf (v0.7.0) codebase was difficult to maintain and prone to errors due to its initial design decisions. Now it is considered deprecated in favour of go-tuf v2 (originaly from rdimitrov/go-tuf-metadata) which started from the idea of providing a Go implementation of TUF that is heavily influenced by the design decisions made in python-tuf.

Contact


Questions, feedback, and suggestions are welcomed on the #tuf and/or #go-tuf channels on CNCF Slack.

We strive to make the specification easy to implement, so if you come across any inconsistencies or experience any difficulty, do let us know by sending an email, or by reporting an issue in the GitHub specification repo.