3 ms·
So obviously we have to wonder why TUF hasn't been applied to NodeJS's npm. All I can find is a suggestion that maybe someone from TUF posted to a node mailing
by doublerebel 10y ago
So obviously we have to wonder why TUF hasn't been applied to NodeJS's npm. All I can find is a suggestion that maybe someone from TUF posted to a node mailing list in 2014 [1]. Any more recent info?
[1]: https://groups.google.com/forum/m/?fromgroups#!topic/theupdateframework/GbWtUbnO8_I https://groups.google.com/forum/m/?fromgroups#!topic/theupda...
- zamalek 10y agoI assume that you'd first need a native JS TUF package published to NPM. I don't think that adding another language dependency is a decision that would be taken lightly. Additionally, I don't see any Windows instructions (NB: python-ffi) and Node supports Windows as a first-class citizen.
- raesene10 10y agoAFAIK several language package managers have looked at implementing TUF for their repositories, but the only live implementation that I know of is Docker Content Trust. I kind of think it's an important part of secure management of libraries. As the Fosshub breach last week showed, software repo's are tempting targets for attackers...