- Home
- Code Signing Software
- The Update Framework
On the recordRead 8 Oct 202626 facts
The Update Framework
On the record
- Browser implementation
- The official site describes TUF Browser as a minimal TypeScript implementation intended to be compatible with browsers.theupdateframework.io · read 8 Oct 2026
- Community support
- The project directs questions and feedback to its Google group and CNCF Slack channel, and lists community meetings as a way to participate.theupdateframework.io · read 7 Oct 2026
- Docker adoption
- The official adoptions page lists Docker registry bindings and a Rust implementation.theupdateframework.io · read 8 Oct 2026
- Governance
- The project’s about page says TUF is managed by the Linux Foundation under the Cloud Native Computing Foundation.theupdateframework.io · read 7 Oct 2026
- How it works
- TUF uses signed metadata to identify trusted update files, downloads them, and checks them before handing them to the software update system.theupdateframework.io · read 8 Oct 2026
- Implementations
- The project lists reference implementations in Python, Go, JavaScript, and Rust, plus third-party implementations in PHP and AWS Labs’ Tough.theupdateframework.io · read 7 Oct 2026
- Integration
- TUF is intended to integrate with new and existing content delivery systems and software update systems.theupdateframework.io · read 7 Oct 2026
- Integrations
- The official getting-started page lists python-tuf, go-tuf, tuf-js, and rust-tuf as reference implementations, and php-tuf and AWS Labs’ tough as third-party implementations.theupdateframework.io · read 8 Oct 2026
- Intended users
- The framework is intended for software update systems such as application updaters, programming language library package managers, and operating system package managers.theupdateframework.io · read 8 Oct 2026
- Key controls
- TUF supports multiple keys, signature thresholds, key replacement and revocation, and reduced trust in keys used online or automatically.theupdateframework.io · read 7 Oct 2026
- Key resilience
- TUF supports multiple signing keys and signature thresholds, revocation and replacement of keys, and minimizing trust in keys kept online.theupdateframework.io · read 8 Oct 2026
- Limit
- TUF does not define package formats or perform the actual update of application files.theupdateframework.io · read 7 Oct 2026
- Limitations
- TUF does not define a universal update system or package formats, perform the actual application file update, or bootstrap secure installation of arbitrary new software.theupdateframework.github.io · read 8 Oct 2026
- Project history
- The project history page says the basic technology was developed at the University of Washington in 2009 and that TUF has been based at NYU Tandon since 2011.theupdateframework.io · read 8 Oct 2026
- Project status
- TUF is a graduated CNCF project.theupdateframework.io · read 8 Oct 2026
- Protection
- TUF is designed to protect update systems even when an attacker compromises a repository or signing keys.theupdateframework.io · read 7 Oct 2026
- Purpose
- TUF is a framework for securing new and existing software update systems, designed to protect against repository and signing key compromise.theupdateframework.io · read 8 Oct 2026
- Related systems
- Listed systems include Repository Service for TUF, tuf-on-ci, Uptane, The Archive Framework, and TUF Browser.theupdateframework.io · read 7 Oct 2026
