The Update Framework

Free plan

What The Update Framework is

The Update Framework (TUF) is an open-source framework and specification developers can adopt to secure software update systems. It is designed for application updaters, language package managers, operating system package managers, and systems distributing other digital artifacts. TUF uses signed metadata to identify trusted files, downloads them, and verifies them before handing them to the update system. That system applies the updates; TUF does not define package formats or perform the file update. Its threat defenses address compromised repositories or signing keys, rollback, freeze, fast-forward, endless data, mix-and-match, malicious mirrors, and other attacks. Key controls include multiple signing keys, signature thresholds, revocation and replacement, and reducing reliance on online keys. Reference implementations are listed for Python, Go, JavaScript, and Rust, with third-party implementations in PHP and AWS Labs’ Tough. TUF is a graduated CNCF project managed by the Linux Foundation under the CNCF. It directs questions and feedback to its Google group and CNCF Slack channel.

Who it suits

TUF suits developers building or securing software update systems, including application updaters and package managers. It provides update-file verification, but the adopting system must apply updates and define its package formats.

What it does well

Designed to address repository and key compromise.
Supports signature thresholds and key revocation.
Reference implementations include Python, Go, JavaScript, and Rust.
Integrates with new and existing update systems.

What to know first

Does not define package formats.
Does not perform application file updates.
Does not bootstrap secure installation of arbitrary new software.

Limits

TUF does not define package formats or apply updates to application files. It also does not bootstrap secure installation of arbitrary new software.

Getting started

Visit the TUF website.
Choose a reference implementation for Python, Go, JavaScript, or Rust, or review the listed third-party implementations.
Integrate TUF with a new or existing content delivery and software update system.
Use signed metadata to identify update files and verify downloaded files before handing them to the update system.
Direct questions or feedback to the CNCF Slack channel or the specification repository.

Verdict

TUF adds metadata-based verification and signing controls to software update systems. Teams need to provide the update behavior and package formats that TUF itself does not define.

Questions

How much does TUF cost?

TUF is free, and its pricing model is listed as free.

Is TUF open source?

Yes. The project describes TUF as open source and a graduated CNCF project.

Which programming languages have implementations?

Reference implementations are listed for Python, Go, JavaScript, and Rust. Third-party implementations include PHP and AWS Labs’ Tough.

Does TUF install or update application files?

TUF identifies updates, downloads them, and verifies files against repository metadata. The software update system applies the files.

Can TUF work with an existing update system?

Yes. It is intended to integrate with new and existing content delivery and software update systems.

Where can users ask questions or report issues?

The project directs users to the CNCF Slack channel #tuf or the specification repository. It also lists a Google group and community meetings.

Facts from The Update Framework's own pages

Browser implementation: The official site describes TUF Browser as a minimal TypeScript implementation intended to be compatible with browsers. · theupdateframework.io, 8 Oct 2026
Community support: The project directs questions and feedback to its Google group and CNCF Slack channel, and lists community meetings as a way to participate. · theupdateframework.io, 7 Oct 2026
Docker adoption: The official adoptions page lists Docker registry bindings and a Rust implementation. · theupdateframework.io, 8 Oct 2026
Founded: 2009 · theupdateframework.io, 28 Sept 2026
Governance: The project’s about page says TUF is managed by the Linux Foundation under the Cloud Native Computing Foundation. · theupdateframework.io, 7 Oct 2026
How it works: TUF uses signed metadata to identify trusted update files, downloads them, and checks them before handing them to the software update system. · theupdateframework.io, 8 Oct 2026
Implementations: The project lists reference implementations in Python, Go, JavaScript, and Rust, plus third-party implementations in PHP and AWS Labs’ Tough. · theupdateframework.io, 7 Oct 2026
Integration: TUF is intended to integrate with new and existing content delivery systems and software update systems. · theupdateframework.io, 7 Oct 2026
Integrations: The official getting-started page lists python-tuf, go-tuf, tuf-js, and rust-tuf as reference implementations, and php-tuf and AWS Labs’ tough as third-party implementations. · theupdateframework.io, 8 Oct 2026
Intended users: The framework is intended for software update systems such as application updaters, programming language library package managers, and operating system package managers. · theupdateframework.io, 8 Oct 2026
Key controls: TUF supports multiple keys, signature thresholds, key replacement and revocation, and reduced trust in keys used online or automatically. · theupdateframework.io, 7 Oct 2026
Key resilience: TUF supports multiple signing keys and signature thresholds, revocation and replacement of keys, and minimizing trust in keys kept online. · theupdateframework.io, 8 Oct 2026
Limit: TUF does not define package formats or perform the actual update of application files. · theupdateframework.io, 7 Oct 2026
Limitations: TUF does not define a universal update system or package formats, perform the actual application file update, or bootstrap secure installation of arbitrary new software. · theupdateframework.github.io, 8 Oct 2026
Project history: The project history page says the basic technology was developed at the University of Washington in 2009 and that TUF has been based at NYU Tandon since 2011. · theupdateframework.io, 8 Oct 2026
Project status: TUF is a graduated CNCF project. · theupdateframework.io, 8 Oct 2026
Protection: TUF is designed to protect update systems even when an attacker compromises a repository or signing keys. · theupdateframework.io, 7 Oct 2026
Purpose: TUF is a framework for securing new and existing software update systems, designed to protect against repository and signing key compromise. · theupdateframework.io, 8 Oct 2026
Related systems: Listed systems include Repository Service for TUF, tuf-on-ci, Uptane, The Archive Framework, and TUF Browser. · theupdateframework.io, 7 Oct 2026
Security audits: The official security audits page lists public reports dated 2015, 2017, 2018, 2022, and 2024, covering TUF and several related implementations or projects. · theupdateframework.io, 8 Oct 2026
Signing systems: The official site lists Repository Service for TUF for integration with existing artifact repositories, tuf-on-ci for CI and Git forge signing workflows, and Uptane for automotive updates. · theupdateframework.io, 8 Oct 2026
Support and community: The specification directs users to the CNCF Slack channel #tuf or the specification repository to report questions and issues. · theupdateframework.github.io, 8 Oct 2026
Threat defenses: The security documentation describes defenses against rollback, freeze, fast-forward, endless data, mix-and-match, and key-compromise attacks. · theupdateframework.io, 7 Oct 2026
Threat protections: TUF is designed to address arbitrary installation, rollback, fast-forward, freeze, endless data, extraneous dependency, mix-and-match, wrong-file, malicious mirror, and key compromise attacks. · theupdateframework.io, 8 Oct 2026

Where The Update Framework stands on Freedom251

Code Signing Software#15 of 28