Securing Content Repositories with the Update Framework (TUF)
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 14:30· Room 402 AB + Online·
summary
Explains how TUF guarantees freshness, consistency and integrity using cryptographic signatures, short-expiry timestamps, role separation, threshold keys and hierarchical delegations, and shows an in-band root rotation workflow; details practical work: a TAP to use Fulcio OIDC short-lived certs for developer signing, experiments to push TUF metadata on registries via Notary V2, a near-complete PyPI integration and refactor of the Python reference, and deployed usage like Fuchsia on Nest Hubs demonstrating real-world IoT rollout.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:28What are content repositories?
- 1:21What might go wrong?
- 2:32It has gone wrong...
- 3:06The Update Framework (TUF)
- 3:42Protect Content
- 4:10Reduce Impact of Key Loss
- 5:52Recover from Compromise
- 7:09TUF Project
- 8:08TUF Deployments
- 11:16Developer key management
- 12:30Notary v2 TUF
- 14:38Integrations
- 15:22Sigstore's TUF root of trust
- 15:58Implementation Updates
- 19:46Questions
related talks
29mSecuring Content Distribution with The Update Framework (TUF)
27mUpdates from The Update Framework
41mUsing TUF to Mitigate Repository Compromises
29mTUF-en up Your Software Supply Chain
41mWhen The Going Gets Tough, Get TUF Going!
34mWhen the Going Gets Tough, Get TUF Going! [I]
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution
26mTUF-En Up Your Signatures