{"categories":[{"label":"Software Development","url":"https://skillfed.io/packages/category/software-development/6"},{"label":"Security","url":"https://skillfed.io/packages/category/security"}],"enrichment":{"capability":"TUF is a Python reference implementation of The Update Framework specification for securing software update systems against supply chain attacks and repository compromise.","skillfed_tags":["supply-chain-security","cryptographic-validation","update-framework"],"use_cases":["Implement secure update delivery for Python applications or services that need protection against repository compromise","Validate software update metadata according to TUF specification in a supply chain security pipeline","Build a custom update system that delegates trust to multiple signing keys with threshold signatures","Integrate TUF metadata validation into a package manager or software distribution system","Audit and verify the integrity of update metadata in an existing update infrastructure"],"what_it_does":"TUF is a reference implementation of The Update Framework specification, a security framework designed to protect software update systems from supply chain attacks, key compromise, and repository tampering. It provides two main APIs: a low-level metadata API for safe access to TUF metadata and serialization, and an ngclient implementation for fetching and validating updates. The package handles the cryptographic validation of update metadata according to the TUF specification, ensuring that even if a repository is compromised or signing keys are stolen, attackers cannot silently distribute malicious updates.\n\nThe framework is production-ready and used by major organizations and open-source projects (including Uptane for automotive over-the-air updates). It's hosted by the Linux Foundation as part of the Cloud Native Computing Foundation. The reference implementation is intended as both a working tool and a readable guide for those implementing TUF in other languages or environments.","worth_installing":"Yes. TUF is a mature, actively maintained reference implementation of a CNCF-backed security standard used in production by major organizations. It has low install friction, no known vulnerabilities, permissive licensing, and supports current Python versions. Install it if you need to secure software updates or validate update metadata according to the TUF specification."},"id":"tuf","links":{"html":"https://skillfed.io/packages/tuf","md":"https://skillfed.io/packages/tuf.md","pypi":"https://pypi.org/project/tuf/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-05-18","license_spdx":"Apache-2.0 OR MIT","license_treatment":"permissive","name":"tuf","python_support":"supports_current","summary":"A secure updater framework for Python"},"popularity":{"monthly_downloads":961921,"position":4631,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"7.0.0"}