aid: tuf name: The Update Framework (TUF) description: >- TUF (The Update Framework) is a CNCF graduated framework for securing software update systems. It provides a specification for how software repositories should be structured and how clients should verify updates to protect against key compromise, rollback attacks, and mix-and-match attacks. TUF is used by many package managers and update systems including PyPI, Sigstore, and various Linux distributions. The framework defines a four-role metadata structure (root, targets, snapshot, timestamp) with threshold signing and delegation capabilities for scalable trust management. url: https://theupdateframework.io image: https://kinlane-productions2.s3.amazonaws.com/apis-json/apis-json-logo.jpg tags: - CNCF - Cloud Native - Graduated - Security - Software Supply Chain - Software Updates - Verification created: '2026-03-16' modified: '2026-05-03' specificationVersion: '0.19' type: Index apis: - aid: tuf:tuf-spec name: TUF Repository Specification description: >- The TUF specification defines the structure of update repositories including the root, targets, snapshot, and timestamp metadata files. Each metadata file has a defined schema with signatures, expiration dates, and delegation rules. Clients follow a defined verification workflow to securely resolve and download updates while protecting against various attack vectors including key compromise, rollback attacks, freeze attacks, and mix-and-match attacks. The specification is version 1.0.31. humanURL: https://theupdateframework.github.io/specification/latest/ properties: - type: Documentation url: https://theupdateframework.github.io/specification/latest/ - type: GitHubRepository url: https://github.com/theupdateframework/specification - type: JSONSchema url: json-schema/tuf-root-metadata-schema.json - type: JSONSchema url: json-schema/tuf-targets-metadata-schema.json - type: JSONSchema url: json-schema/tuf-snapshot-metadata-schema.json - type: JSONSchema url: json-schema/tuf-timestamp-metadata-schema.json tags: - Metadata - Repository Metadata - Specification - Verification - aid: tuf:python-tuf name: TUF Python Reference Implementation description: >- The official Python reference implementation of The Update Framework (TUF) specification. Provides a metadata API for reading and writing TUF metadata files, an ngclient API implementing the TUF client update workflow, and a repository library for building TUF-compliant software repositories. Available on PyPI as the 'tuf' package. humanURL: https://theupdateframework.readthedocs.io/en/stable/ properties: - type: Documentation url: https://theupdateframework.readthedocs.io/en/stable/ - type: GitHubRepository url: https://github.com/theupdateframework/python-tuf - type: PackageRegistry url: https://pypi.org/project/tuf/ tags: - Client Library - Python - Security - Software Updates - Supply Chain - aid: tuf:go-tuf name: TUF Go Implementation description: >- A Go implementation of The Update Framework (TUF), heavily influenced by python-tuf's design. Provides metadata, TrustedMetadata, and Updater packages implementing the TUF client workflow and specification-compliant metadata handling, as well as multi-repository support via TAP 4. humanURL: https://github.com/theupdateframework/go-tuf properties: - type: Documentation url: https://github.com/theupdateframework/go-tuf - type: GitHubRepository url: https://github.com/theupdateframework/go-tuf tags: - Client Library - Go - Security - Software Updates - Supply Chain - aid: tuf:rust-tuf name: TUF Rust Implementation description: >- A Rust implementation of The Update Framework (TUF) specification providing a strongly-typed API for working with TUF metadata, verifying signatures, and implementing the TUF client update workflow. humanURL: https://github.com/theupdateframework/rust-tuf properties: - type: GitHubRepository url: https://github.com/theupdateframework/rust-tuf tags: - Client Library - Rust - Security - Software Updates - aid: tuf:tuf-js name: TUF JavaScript Implementation description: >- A JavaScript/TypeScript implementation of The Update Framework (TUF) for use in Node.js environments and browser-based update systems. Enables TUF-compliant software update verification in the JavaScript ecosystem. humanURL: https://github.com/theupdateframework/tuf-js properties: - type: GitHubRepository url: https://github.com/theupdateframework/tuf-js tags: - Client Library - JavaScript - Security - Software Updates - TypeScript - aid: tuf:tuf-on-ci name: TUF on CI description: >- A TUF repository management and signing tool designed for use in CI/CD pipelines. Enables teams to maintain a TUF repository using GitHub Actions and other CI systems for automated, policy-driven key management and metadata signing workflows. humanURL: https://github.com/theupdateframework/tuf-on-ci properties: - type: GitHubRepository url: https://github.com/theupdateframework/tuf-on-ci tags: - CI/CD - Key Management - Repository Management - Security - aid: tuf:tuf-conformance name: TUF Conformance Test Suite description: >- The official TUF client conformance test suite for verifying that TUF client implementations correctly implement the TUF specification, including proper handling of all attack vectors and edge cases. humanURL: https://github.com/theupdateframework/tuf-conformance properties: - type: GitHubRepository url: https://github.com/theupdateframework/tuf-conformance tags: - Compliance - Conformance Testing - Security - Testing common: - type: Website url: https://theupdateframework.io/ - type: Documentation url: https://theupdateframework.io/docs/ - type: GettingStarted url: https://theupdateframework.io/docs/getting-started/ - type: GitHub Organization url: https://github.com/theupdateframework - type: GitHubRepository url: https://github.com/theupdateframework/python-tuf - type: Specification url: https://theupdateframework.github.io/specification/latest/ - type: Blog url: https://theupdateframework.io/resources/news/ - type: CNCF url: https://www.cncf.io/projects/the-update-framework-tuf/ - type: Community url: https://github.com/theupdateframework/community - type: JSON-LD url: json-ld/tuf-context.jsonld - type: JSONSchema url: json-schema/tuf-root-metadata-schema.json - type: JSONSchema url: json-schema/tuf-targets-metadata-schema.json - type: JSONSchema url: json-schema/tuf-snapshot-metadata-schema.json - type: JSONSchema url: json-schema/tuf-timestamp-metadata-schema.json - type: Vocabulary url: vocabulary/tuf-vocabulary.yml maintainers: - FN: Kin Lane email: kin@apievangelist.com