TUF-En Up Your Signatures

on YouTube ↗26m

" summary

TUF is a compromise‑resilient update framework used by sigstore, Notary and Google Fuchsia that limits damage when repositories or signing keys are breached and supports seamless revocation and recovery; deployments span cloud registries, automotive/IoT (Uptane) and an archive framework, with >10 years production use, a graduated CNCF project and OpenSSF Gold status. Implementations include python‑tuf and go‑tuf; TAPs cut metadata with succinct delegations that reduce overhead by 8x and pursue a canonical JSON removal and coordinated versioning for a 2.0.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 1:35Repository Compromise
3. 5:45The Update Framework (TUF)
4. 7:32Responsibility Separation
5. 8:25TUF Design Principles
6. 12:43TUF Status
7. 13:32TUF Implementations
8. 16:59TAP 14: Managing TUF Versions
9. 17:43TAP 17: Remove Signature Wrapper
10. 20:22Secure Software Supply Chain Integration
11. 22:25Contribute to TUF

" related talks

• 34mWhen the Going Gets Tough, Get TUF Going! [I]Ashwini Oruganti, David Lawrence · KubeCon + CloudNativeCon North America 2017
• 36mTUF / Notary Project IntroDavid Lawrence, Justin Cappos · KubeCon + CloudNativeCon Europe 2018
• 39mIntro: TUF / NotaryJustin Cormack, Justin Cappos · KubeCon + CloudNativeCon Europe 2019
• 29mTUF-en up Your Software Supply ChainMarina Moore, Kairo De Araujo · KubeCon + CloudNativeCon Europe 2025
• 18mBeyond signatures: Using TUF and Notary to Secure Software DistributionMarina Moore · Cloud Native Security Day Europe 2021
• 41mDeep Dive: TUF / NotaryJustin Cappos, Lukas Puehringer · KubeCon + CloudNativeCon Europe 2019
• 41mWhen The Going Gets Tough, Get TUF Going!Riyaz Faizullabhoy · LinuxCon + ContainerCon North America 2016
• 41mUsing TUF to Mitigate Repository CompromisesMarina Moore, Justin Cappos · KubeCon + CloudNativeCon North America 2019