Hacker News Reader

Comment by Titanous | Hacker News Reader

If you're interested in securing software update systems, check out The Update Framework. TUF is the only system I'm aware of that has a comprehensive threat model for the problem of securely distributing software updates.

https://theupdateframework.github.io

View on HN

It's not the only system, unless you assume all of the same requirements and constraints that TUF proposes as necessary. There are other systems that do many of the same things that TUF proposes.

TUF also attempts to address a set of problems that some systems don't need to solve because it isn't a need they have.

With that said, I would agree that TUF provides a great model.

Skimmed the spec, it sounds interesting, but I'm seemingly unable to find an architecture diagram / any kind of visualization to let me wrap my head around the actual framework.

I'm not sure how connected to the project you are, but if you're aware of where I might find that, I'd be very thankful for a helping hand.

And it has a BSD license, too. Unfortunately it's written in Python. I don't see Python becoming a requirement to update FreeBSD.

There is also a BSD-licensed version that we wrote in Go: https://github.com/flynn/go-tuf

But then you would have to ship and support a go compiler with base, which is a similar problem but easier to overcome.

Or ship compiled static binaries.

This would be more feasible, but we'd still need Go in the src tree so users can reproduce them.

The website says there are Python, Ruby, Go, and Haskell implementations of the framework.

Reply on news.ycombinator.com