Repository Service for TUF Documentation

Repository Service for TUF (RSTUF)

OpenSSF Best Practices


Repository Service for TUF is a work in progress.

RSTUF is currently (November 2022) considered experimental, use with caution.

See our ROADMAP to understand when this disclaimer may be removed.

Repository Service for TUF (RSTUF) is a system for securing content downloads from tampering between the repository and the client (for example, by an on-path attacker).

RSTUF is designed to be integrated with existing content delivery solutions – at the edge or in public/private clouds – alongside current artifact production systems, such as build systems, including; Jenkins, GitHub Actions, GitLab, CircleCI, etc. RSTUF protects downloading, installing, and updating content from arbitrary content repositories, such as a web server, JFrog Artifactory, GitHub packages, etc.

RSTUF security properties are achieved through implementing The Update Framework (TUF) as a service.

RSTUF simplifies adoption of TUF by removing the need to design a repository integration – RSTUF encapsulates that design.

Integrating RSTUF into your existing content delivery solutions is simple thanks to the REST API. Furthermore, RSTUF is designed for scalability and can support very active repositories with multiple repository workers.

At present, RSTUF implements a streamlined variant of the Python Package Index (PyPI)’s PEP 458 – Secure PyPI downloads with signed repository metadata. In future, RSTUF will grow to provide additional protections through supporting end-to-end signing of packages, comparable to PyPI’s PEP 480 – Surviving a Compromise of PyPI: End-to-end signing of packages.

Questions, feedback, and suggestions are welcomed on the #repository-service-for-tuf channel on CNCF Slack.

How does Repository Service for TUF compare to other solutions?

Rugged: Repository Service for TUF is a collection of services to deploy a scalable and distributed TUF Repository. RSTUF provides an easy interface to integrate (the REST API) and a tool for managing the Metadata Repository (CLI).

PyPI/PEP 458: Repository Service for TUF is a generalization of the design in PEP 458 that can be integrated into a variety of content repository architectures.


Documentation List