@sigstore/tuf
Advanced tools
Package description
@sigstore/tuf is an npm package that provides functionalities for secure software supply chain management using The Update Framework (TUF). It helps in ensuring the integrity and authenticity of software updates.
Initialize TUF Client
This feature allows you to initialize a TUF client with a specified remote repository URL and a local cache path. The TUF client is used to interact with the TUF repository for secure updates.
const { TUFClient } = require('@sigstore/tuf');
const client = new TUFClient({
remoteRepoURL: 'https://example.com/tuf-repo',
localCachePath: './tuf-cache'
});Fetch Metadata
This feature allows you to fetch metadata from the TUF repository. In this example, it fetches the 'root.json' metadata file and logs it to the console.
async function fetchMetadata() {
const metadata = await client.getMetadata('root.json');
console.log(metadata);
}
fetchMetadata();Verify Targets
This feature allows you to verify the integrity and authenticity of a target file using the TUF client. It checks if the target file is valid according to the TUF metadata.
async function verifyTarget(targetFile) {
const isValid = await client.verifyTarget(targetFile);
console.log(`Target ${targetFile} is valid: ${isValid}`);
}
verifyTarget('example-target.txt');tuf-js is a JavaScript implementation of The Update Framework (TUF). It provides similar functionalities for secure software update management. Compared to @sigstore/tuf, tuf-js is more focused on providing a pure JavaScript implementation of TUF without additional integrations.
in-toto is a framework that provides end-to-end security for the software supply chain. It ensures the integrity and authenticity of the software by tracking the entire supply chain. While @sigstore/tuf focuses on secure updates, in-toto provides a broader scope by securing the entire software development lifecycle.
Readme
A JavaScript library for securely retrieving targets from the Sigstore TUF repository.
npm install @sigstore/tuf
const { initTUF } = require('@sigstore/tuf')
import { initTUF } from '@sigstore/tuf'
Returns a TUF client which can be used to retrieve any target from the Sigstore TUF repository. The local TUF cache will be initialized and the TUF metadata files downloaded from the remote repository as part of the initialization process.
options <Object>
mirrorURL <string>: Base URL for the Sigstore TUF repository. Defaults to 'https://tuf-repo-cdn.sigstore.dev'cachePath <string>: Absolute path to the directory to be used for caching downloaded TUF metadata and targets. Defaults to a directory named "sigstore-js" within the platform-specific application data directory.rootPath <string>: Path to the initial trust root for the TUF repository. Defaults to the embedded root.The TUF client object returned from initTUF has a single getTarget
function which takes the name of a target in the Sigstore TUF repository
and returns the content of that target.
Retrieves the most recent version of the "trusted_root.json" target from the Sigstore TUF repository. The format of "trusted_root.json" file is described by the TrustedRoot protobuf and contains the complete set of trusted verification materials for the Sigstore public-good instance.
options <Object>
mirrorURL <string>: Base URL for the Sigstore TUF repository. Defaults to 'https://tuf-repo-cdn.sigstore.dev'cachePath <string>: Absolute path to the directory to be used for caching downloaded TUF metadata and targets. Defaults to a directory named "sigstore-js" within the platform-specific application data directory.rootPath <string>: Path to the initial trust root for the TUF repository. Defaults to the embedded root.FAQs
Client for the Sigstore TUF repository
The npm package @sigstore/tuf receives a total of 4,478,396 weekly downloads. As such, @sigstore/tuf popularity was classified as popular.
We found that @sigstore/tuf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Git dependencies in open source packages can introduce significant risks, including lack of version control, stability issues, dependency drift, and difficulty in auditing, making them potential targets for supply chain attacks.
Security News
Node.js has added experimental support for TypeScript, a move that highlights the growing importance of TypeScript in modern development.
Product
Check out what's new at Socket with our Product Changelog. It tracks all public-facing updates, improvements, and fixes so you can take full advantage of our features.