Securing Content Distribution with RSTUF, an Incubating OpenSSF Project
summary
RSTUF is an incubating OpenSSF project that implements a generic TUF repository service and is already in use for PyPI and RubyGems staging tests and private repos. It ships as a CLI plus Helm charts, requires Postgres and Redis, and proxies artifacts on S3/Nexus/JFrog rather than hosting them. Features include key rotation and revocation, delegation, KMS/HashiCorp Vault and Sigstore signing, API calls from CI/CD, import of millions of artifacts, and a 0.0.0-beta services release with a planned security audit.
AI-written summary · about
chapters (11)
- 0:00Introduction to RSTUF
- 1:05Why protect repositories
- 3:36Limitations of TUF
- 4:19Introducing RSTUF
- 6:50RSTUF use cases
- 7:54Deployment with Helm
- 8:58Real-world example setup
- 13:41Integration with in-toto
- 17:32Policy signing with RSTUF
- 20:00Current state and next steps
- 21:03Q&A and closing
related talks
22mSecuring Content Repositories with the Update Framework (TUF)
29mSecuring Content Distribution with The Update Framework (TUF)
29mTUF-en up Your Software Supply Chain
41mUsing TUF to Mitigate Repository Compromises
38mSecuring Git Repositories with Gittuf
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
27mUpdates from The Update Framework
26mTUF-En Up Your Signatures