4 ms·

If you're interested in securing software update systems, check out The Update Framework. TUF is the only system I'm aware of that has a comprehensive threat mo

If you're interested in securing software update systems, check out The Update Framework. TUF is the only system I'm aware of that has a comprehensive threat model for the problem of securely distributing software updates. https://theupdateframework.github.io https://theupdateframework.github.io

chriscappuccio 10y ago
And it has a BSD license, too. Unfortunately it's written in Python. I don't see Python becoming a requirement to update FreeBSD.
- Titanous 10y ago
  There is also a BSD-licensed version that we wrote in Go: https://github.com/flynn/go-tuf https://github.com/flynn/go-tuf
  - mveety 10y ago
    But then you would have to ship and support a go compiler with base, which is a similar problem but easier to overcome.
    - Titanous 10y ago
      Or ship compiled static binaries.
      - feld 10y ago
        This would be more feasible, but we'd still need Go in the src tree so users can reproduce them.
- milcron 10y ago
  The website says there are Python, Ruby, Go, and Haskell implementations of the framework.
akerl_ 10y ago
Skimmed the spec, it sounds interesting, but I'm seemingly unable to find an architecture diagram / any kind of visualization to let me wrap my head around the actual framework. I'm not sure how connected to the project you are, but if you're aware of where I might find that, I'd be very thankful for a helping hand.
binarycrusader 10y ago
It's not the only system, unless you assume all of the same requirements and constraints that TUF proposes as necessary. There are other systems that do many of the same things that TUF proposes. TUF also attempts to address a set of problems that some systems don't need to solve because it isn't a need they have. With that said, I would agree that TUF provides a great model.