A Framework for Securing Software Update Systems
The Update Framework (TUF) helps developers secure their new or existing software update systems. Software update systems are vulnerable to many known attacks, including those that can result in clients being compromised or crashed. TUF helps solve this problem by providing a flexible security framework that can be added to software updaters.
What is a software update system?
Generally, a software update system is an application (or part of an application) running on a client system that obtains and installs software. This can include updates to software that is already installed or even completely new software.
Three major classes of software update systems are:
- Application updaters which are used by applications use to update themselves. For example, Firefox updates itself through its own application updater.
- Library package managers such as those offered by many programming languages for installing additional libraries. These are systems such as Python's pip/easy_install + PyPI, Perl's CPAN, Ruby's Gems, and PHP's PEAR.
- System package managers used by operating systems to update and install all of the software on a client system. Debian's APT, Red Hat's YUM, and openSUSE's YaST are examples of these.
Our approach
There are literally thousands of different software update systems in common use today. (In fact the average Windows user has about two dozen different software updaters on their machine!)
We are building a specification and library that can be universally (and in most cases transparently) used to secure software update systems.
News
August 12, 2015
In TUF adoption news... the Docker team announced Docker Content Trust, which integrates TUF via Notary. Docker Content Trust will be available starting with Docker 1.8, and supports image signing and verification. For more information on the Docker + TUF integration, please visit: https://blog.docker.com/2015/08/content-trust-docker-1-8/
How do I learn more?
For more information, look at the following:
Papers:
- Survivable Key Compromise in Software Update Systems
- A Look in the Mirror: Attacks on Package Managers
- Package Management Security
Integrations
Docker Distribution
Flynn
LEAP Encryption Access Project
Notary
Securing Python package management
- PEP 458: Securing the Link from PyPI to the End User
- PEP 480: Surviving a Compromise of PyPI
- PyCon 2013 lightning talk (Slides)
- PyCon US 2011 talk
- Test pip with TUF
- Automation for creating, updating and destroying a TUF-secured PyPI mirror
- Source code of pip with TUF
Securing Ruby package management
- Developers from Square have demonstrated an initial implementation of TUF for RubyGems
- Atlassian Dev Den Tech Talk Series: Securing Rubygems with TUF
- Securing RubyGems with TUF, Part 1
- Securing RubyGems with TUF, Part 2
- Securing RubyGems with TUF, Part 3
CoreOS App Container Specification
Hackage, Haskell's Central Package Archive
Signing the OPAM Repository: TUF Meets Git
Other implementations
Press
- Notary demoed at the DockerCon 2015 keynote
- LWN.net: Docker image "verification"
- Poster at PyCon 2015
- LWN.net: Protecting Python package downloads
- The Linux Magazine: TUF Love
- Docker Image Insecurity
- Hacker News: Incremental Plans to Improve Python Packaging
- Promotional materials on TUF (The Update Framework) w/ Justin Cappos and Trishank Kuppusamy
- Slashdot: Package Managers As Achilles Heel
Acknowledgements
This material is based upon work supported by the National Science Foundation under Grant No. CNS-1345049 and CNS-0959138. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.