@sigstore/tuf

What is @sigstore/tuf?

@sigstore/tuf is an npm package that provides functionalities for secure software supply chain management using The Update Framework (TUF). It helps in ensuring the integrity and authenticity of software updates.

What are @sigstore/tuf's main functionalities?

Initialize TUF Client

This feature allows you to initialize a TUF client with a specified remote repository URL and a local cache path. The TUF client is used to interact with the TUF repository for secure updates.

const { TUFClient } = require('@sigstore/tuf');
const client = new TUFClient({
  remoteRepoURL: 'https://example.com/tuf-repo',
  localCachePath: './tuf-cache'
});

Fetch Metadata

This feature allows you to fetch metadata from the TUF repository. In this example, it fetches the 'root.json' metadata file and logs it to the console.

async function fetchMetadata() {
  const metadata = await client.getMetadata('root.json');
  console.log(metadata);
}
fetchMetadata();

Verify Targets

This feature allows you to verify the integrity and authenticity of a target file using the TUF client. It checks if the target file is valid according to the TUF metadata.

async function verifyTarget(targetFile) {
  const isValid = await client.verifyTarget(targetFile);
  console.log(`Target ${targetFile} is valid: ${isValid}`);
}
verifyTarget('example-target.txt');

Other packages similar to @sigstore/tuf

tuf-js

tuf-js is a JavaScript implementation of The Update Framework (TUF). It provides similar functionalities for secure software update management. Compared to @sigstore/tuf, tuf-js is more focused on providing a pure JavaScript implementation of TUF without additional integrations.

README

@sigstore/tuf ·

A JavaScript library for securely retrieving targets from the Sigstore TUF repository.

Features

• Embeds the trutsted root metadata file necessary to bootstrap interaction with the Sigstore TUF repository.
• Automatically initializes the local TUF cache for storing metadata and target files.

Prerequisites

• Node.js version >= 18.17.0

Installation

npm install @sigstore/tuf

Usage

const { initTUF } = require('@sigstore/tuf');

import { initTUF } from '@sigstore/tuf';

initTUF([options])

Returns a TUF client which can be used to retrieve any target from the Sigstore TUF repository. The local TUF cache will be initialized and the TUF metadata files downloaded from the remote repository as part of the initialization process.

• options <Object>
  • mirrorURL <string>: Base URL for the Sigstore TUF repository. Defaults to 'https://tuf-repo-cdn.sigstore.dev'
  • cachePath <string>: Absolute path to the directory to be used for caching downloaded TUF metadata and targets. Defaults to a directory named "sigstore-js" within the platform-specific application data directory.
  • rootPath <string>: Path to the initial trust root for the TUF repository. Defaults to the embedded root.
  • forceInit boolean: Force re-initialization of the TUF cache even if it already exists. Defaults to false.
  • forceCache boolean: Prevents any downloads from the remote TUF repository as long as all cached metadata files are un-expired. Defaults to false.
  • force boolean: Same as forceInit (deprecated).

The TUF client object returned from initTUF has a single getTarget function which takes the name of a target in the Sigstore TUF repository and returns the content of that target.

getTrustedRoot([options])

Retrieves the most recent version of the "trusted_root.json" target from the Sigstore TUF repository. The format of "trusted_root.json" file is described by the TrustedRoot protobuf and contains the complete set of trusted verification materials for the Sigstore public-good instance.

• options <Object>
  • mirrorURL <string>: Base URL for the Sigstore TUF repository. Defaults to 'https://tuf-repo-cdn.sigstore.dev'
  • cachePath <string>: Absolute path to the directory to be used for caching downloaded TUF metadata and targets. Defaults to a directory named "sigstore-js" within the platform-specific application data directory.
  • rootPath <string>: Path to the initial trust root for the TUF repository. Defaults to the embedded root.
  • forceInit boolean: Force re-initialization of the TUF cache even if it already exists. Defaults to false.
  • forceCache boolean: Prevents any downloads from the remote TUF repository as long as all cached metadata files are un-expired. Defaults to false.
  • force boolean: Same as forceInit (deprecated).