# Secure your software update systems with TUF ## What is a software repository? A software repository stores software updates for a large number of software projects or releases. It can be hosted on a server, local hard disks, or in a content delivery network (CDN). The updates could be packages, binary files, update folders, or source code. Examples of software repositories include Python Package Index (PyPI), Node Package Manager (npm), MySQL Yum, RubyGems, Packagist for PHP, GitHub and GitLab. ## What is a software update system? A software update system finds and notifies users of the latest versions of software, known as updates, and then downloads and installs the updates from the software repository. The processes in a software update system include verification, installation, and distribution. Examples include **system package managers** for installing software in operating systems, **library managers** for installing libraries in programming environments, and **application updaters** for installing individual self-updating software applications that do not need a manual update process. The following are examples of software update systems: 1. **System package managers**: openSUSE's YaST, Red Hat's YUM, Debian's APT. 2. **Library package managers**: Node.js' npm, Python's pip, Ruby's Gem. 3. **Application updaters**: Firefox. The relationship between a software repository and a software update system can be seen in the usage of pip and PyPI. PyPI is a repository that stores python packages, while pip is the software update system that automatically updates the latest version of the Python packages in the software project. The software update system behaves as the client requesting updates, while the repository behaves as the server responding with information describing the update. ## Security Vulnerabilities in software update systems Attackers can respond to a client request and compromise the trusted keys for signing the updates in the software update system or the protocols in the Transport Layer Security (TLS) of the software update system. These vulnerabilities are attributed to key theft, the use of keys with cryptographic weaknesses, or the use of a single trusted key to perform all the signatures needed for authentication. These threats and attacks lead to different security compromises, such as trusted keys being used to sign malicious software along with the update files, the client-to-server response time being delayed to prevent the update process from completing (freeze attack), the client responds with the wrong, outdated version of the update (rollback attack), or the developer account being used to push a malicious update to the repository. It is important to build resilient software update systems that can mitigate these security threats and attacks. ## What is The Update Framework (TUF)? [TUF](https://theupdateframework.io/) is an open source security framework designed to identify vulnerabilities and improve the resilience of software update systems. It can be implemented in different programming languages using different libraries such as [go-tuf](https://github.com/theupdateframework/go-tuf/), [tuf-js](https://github.com/theupdateframework/tuf-js), [rust-tuf](https://github.com/theupdateframework/rust-tuf), or [python-tuf](https://github.com/theupdateframework/python-tuf). As an open source project, TUF can be used as customised extensions such as [RSTUF](https://repository-service-tuf.readthedocs.io/en/stable/), [tuf-on-ci](https://github.com/theupdateframework/tuf-on-ci/), [Uptane](https://uptane.org/), [TUF Browser](https://github.com/freedomofpress/tuf-browser), and [TAF](https://github.com/openlawlibrary/taf). TUF enables the security and sustainability of the software supply chain. It is widely adopted by developers and DevOps teams across different organisations such as Cloudflare, Datadog, and Amazon. During the update process, the software update system needs to verify the authenticity of the following information when receiving the updates: 1. **Content of the update**: The information describing the update, such as the update files and the metadata. 2. **Timeliness of the update:** The period of time in which the update became available in the repository. 3. **State of the repository**: The set of update files and metadata available from the repository at a given period of time. TUF is designed with the following security principles: 1. **Responsibility separation and delegation**: Multiple roles are assigned to perform different methods for verifying the authenticity of the update. The software update system may use either SSL/TLS or signing keys for verifying the update. The roles are categorised into root, timestamp, mirror, targets, and snapshot roles. 2. **Multisignature trust**: The key needs to be signed by multiple roles before it can be trusted. Trust is achieved through different approaches: threshold signatures and signatures shared between multiple roles with separate keys. 3. **Implicit and explicit revocation**: Vulnerable keys in the software update system can be revoked when the keys are suspected, lost, weak, compromised, or rotated among members. When trusted keys expire over time, they are implicitly revoked. When trusted keys are no longer trusted, they are explicitly revoked. This reduces the need for storing keys on public-facing servers. ## TUF Roles A role defines a set of actions that a party is trusted to perform. Only specified keys with delegated roles are authorised and trusted for specific signatures. An example is a role that can be used for signing metadata that indicates developer keys that belong to a software project. The following are the key-signing roles in TUF: 1. **Root role**: Compulsory. Responsible for delegating responsibilities to other roles in the repository. The root is the single source of trust for the entire repository. It signs the `root.json` metadata file. The root's purpose is to maintain unified control in the software update system when threats and attacks are identified. 2. **Targets role**: Compulsory. Responsible for providing information about the target files are the update files available in the repository. The target role is also capable of delegating trust to other roles 3. **Snapshot role**: Compulsory. Responsible for providing information about the latest versions of all metadata files. It ensures that the client sees a consistent state of the repository. 4. **Timestamp role**: Compulsory. Responsible for providing information about the timeliness of the update. Timeliness is made available through frequently signed `timestamp.json` files indicated with their time of expiration. The timestamp file is usually created after the snapshot file. 5. **Mirror role**: Optional. When the target files are downloaded by the client, the repository's mirror also contains its metadata. A mirror key performs its responsibility of signing the mirror's metadata. ## Conclusion This article explained the relationship between a software repository and a software update, the security threats and attacks in software update systems and how TUF mitigate the threats and attacks using roles and metadata based on its principles of security design.