Python reference implementation of The Update Framework (TUF)
APACHE-2.0 License
Bot releases are hidden (Show)
Published by jku over 2 years ago
This release makes ngclient and the Metadata API the supported python-tuf APIs.
It also removes the legacy implementation as documented in the 1.0.0 announcement:
all library code is now contained in tuf.api
or tuf.ngclient
.
See Python-TUF reaches version 1.0.0 for a blog post about this release.
Published by lukpueh almost 3 years ago
NOTE: This will be the final release of python-tuf that includes the legacy implementation code. Please see the 1.0.0 announcement page for more details about the next release and the deprecation of the legacy implementation, including migration instructions.
Published by jku almost 3 years ago
For users of legacy client (tuf.client module) this is purely a security fix
release with no API or functionality changes. For ngclient (tuf.ngclient) and
Metadata API (tuf.api.metadata), some API changes are included.
All users are advised to upgrade.
Note that python-tuf has required python>=3.5 since release 0.18.0.
Published by joshuagl about 3 years ago
Note: The v0.18.0 release was made with the changes from #1566, resulting in
a release with sources which don't match the git tag. We are rectifying this
with this v0.18.1 release.
0.18 is a big release with 3 main themes:
Additionally the Github project name changed: project is now "python-tuf"
instead of "tuf". Redirects are in place for the old name but updating links is
advised.
Please see https://github.com/theupdateframework/python-tuf/releases/tag/v0.18.0
Published by joshuagl about 3 years ago
0.18 is a big release with 3 main themes:
Additionally the Github project name changed: project is now "python-tuf"
instead of "tuf". Redirects are in place for the old name but updating links is
advised.
Published by joshuagl over 3 years ago
NOTE: this will be the final release of tuf that supports Python 2.7.
This is because Python 2.7 was marked end-of-life in January of 2020, and
since then several of tuf's direct and transient dependencies have stopped
supporting Python 2.7.
Published by joshuagl almost 4 years ago
tuf.api
(#1193)aggregate_tests
) and stop executing unit testsleep()
calls (#1194)Queue
s, rather than files,tuf.client.updater
(#1219)[]
) as the default argument in a test_verify_root_self_signed()
such thatPublished by lukpueh almost 4 years ago
tuf.api
package for interacting withMissingLocalRepositoryError
in updater when local repository can notfileinfo
(#1078)tuf.client.updater
when metadata is loaded without atuf.repository_tool
when metadata is written without atargets_path
, metadata_path
and confined_target_dirs
fields intuf.client.updater
s mirror configuration optional (#1153, #1166)colorama
and dependency (#1180)requests.Responses
are closed during tests (#1147)securesystemslib
head of development (#1185)tuf.repository_lib
error message (#1078)Published by joshuagl about 4 years ago
consistent_snapshot
is enabled for a repository (#1102)keyid_hash_algorithms
(#1014, #1121)keyid_hash_algorithms
(#1014, #1121)securesystemslib.settings.HASH_ALGORITHMS
, instead passkeys.format_metadata_to_key
(#1016)Published by joshuagl about 4 years ago
Published by SantiagoTorres almost 5 years ago
Published by lukpueh almost 5 years ago
Published by lukpueh about 5 years ago
Published by awwad almost 6 years ago
Published by awwad almost 6 years ago
Published by awwad about 6 years ago
For now, this development release does not include a full changelog entry. To see the full list of changes, see this commit list.
Published by vladimir-v-diaz over 6 years ago
Prevent persistent freeze attack (pr #737).
Add --no-release option to CLI.
Issue deprecation warning for all_targets() and targets_of_role().
Disable file logging, by default.
Tweak network settings (in settings.py) for production environments.
Add tuf.log.enable_file_logging() and tuf.log.disable_file_logging().
Replace %xx escapes in URLs.
Support Appveyor (for Windows) with Continuous Integration.
Run unit tests in Python 3.4 & 3.5 under Appveyor.
Edit contact text to encourage users to report issues with specification.
Generate (w/ CLI) Ed25519 keys, by default.
Upgrade dependencies to latest versions.
Add requirements.in, which is used to generate the other requirement files.
Update list of adopters.
Convert README to Markdown.
Update installation instructions to note SSLib's optional dependencies
that should be installed to support RSA, ECDSA, etc. keys.
Add unit test for persistent freeze attack.
Update list of tasks in ROADMAP.md.
Published by vladimir-v-diaz over 6 years ago
Note: This is a backwards-incompatible pre-release.
Make significant improvements to execution speed of updater.
Resolve all of the unit test failures in Windows.
Add or revise many CLI options.
Revise CLI documentation, such as QUICKSTART.md.
Ensure consistent behavior between add_targets and add_target().
Add a CLI doc that demonstrates more complex examples.
Move LICENSE files to the root directory.
Update dependencies.
Update TUTORIAL.md to fix links.
Fix bug where the latest consistent metadata is not loaded.
Modify the pyup update schedule from daily to weekly.
Add hashes to requirements.txt.
Update AUTHORS.txt and add organizations.
Replace deprecated 'cryptography' functions.
Remove dependency in dev-requirements.txt that causes error.
Ensure that the latest consistent metadata is added to Snapshot.
Tweak a few logger and exception messages.
Revise introductory text in README.
Update ADOPTERS.md and link to pages that cover each adoption.
Remove target paths in metadata that contain leading path separators.
Address Pylint/Bandit warnings for the CLI modules.
Replace calls to deprecated 'imp' module.
Fix bug where the hashing algorithms used to generate local KEYIDs does not
match the ones chosen by the repo.
Fix bug in tuf.sig.get_signature_status() where a given threshold is not used.
Refactor code that stores the previous keyids of a role.
Published by vladimir-v-diaz over 6 years ago
Note: This is a backwards-incompatible pre-release.
Support TAP 4 (multiple repository concensus on entrusted targets).
https://github.com/theupdateframework/taps/blob/master/tap4.md
Add quick start guide.
Add CLI (repo.py) to create and modify repositories.
Refactor client CLI (client.py).
Add pyup.io to manage dependencies.
Update all dependencies to their latest versions.
Add Pylint and Bandit (security) linters to Travis CI. Fix issues reported
by both linters.
Tidy up documenation and directory structure.
Add option to exclude custom field when returning valid targetinfo with
MultiRepoUpdater.get_valid_targetinfo().
Fix PGP key fingerprint provided for security vulnerability reports.
Modify API for creating delegations.
Add wrapper functions for securesystemslib functions.
Fix bug: non-default repository names raises an exception.
Refactor modules for inconsistent use of whitespace and indentation.
Add cryptographic functions to read and write keys from memory.
Add full support for ECDSA keys. List ecdsa-sha2-nistp256
in specification.
Remove example metadata. Documentation now points to up-to-date metadata
in the tests directory.
Remove all references to PyCrypto.
Add copyright and license to all modules.
Add README for the unit tests.
Remove remnants of the compressed metadata feature (now discontinued).
Fix minor issues such as broken links, typos, etc.
Update configuration files to fix issues, such as duplicate upgrade commands,
badges, etc.
Revise policy on static code analysis, CI, etc.
Earn CII Best Practices Badge.
Reach 98% score for CII Silver Badge.
Remove obsolete code, such as tufcli.py, interposition,
check_crypto_libraries(), etc.
Published by vladimir-v-diaz almost 7 years ago
Note: This is a backwards-incompatible pre-release.
Add CHANGELOG.md, MAINTAINERS.txt, CODE-OF-CONDUCT.md, GOVERNANCE.md,
ADOPTERS.md, DCO requirements, and instructions for submitting a vulnerability
report.
Move specification to github.com/theupdateframework/specification.
Dual license the project: MIT license and Apache license, version 2.
Update to latest version of securesystemslib v0.10.8, which dropped PyCrypto
and multi-lib support.
Add ecdsa-sha2-nistp256 to specification.
Remove directory of example metadata. Documentation now references unit test
metadata.
Implement TAP 9 (mandatory metadata signing schemes).
https://github.com/theupdateframework/taps/blob/master/tap9.md
Drop support for Python 2.6 and 3.3.
Support Python 3.6.
Improve code coverage to 99%.
Convert specification from text to Markdown format.
Add MERCURY paper, which covers protection against roleback attacks.
Implement TAP 6 (include specification version in metadata).
Implement TAP 10 (remove native support for compressed metadata).
Support ability to append an externally-generated signature to metadata.
Remove capitalization from rolenames listed in metadata.
Add a more detailed client workflow to specification.
Modify client workflow: A client must now fetch root first. Intermediate
versions of Root must also be downloaded and verified by the client. See
specification for modified workflow.
Fix bug with key IDs, where incorrect number of key IDs are detected.
Minor bug fixes, such as catching correct type and number of exceptions,
detection of slow retrieval attack, etc.
Do not list Root's hash and lenth in Snapshot (only its version number).
Allow user to configure hashing algorithm used to generate hashed bin delegations.
Fix Markdown errors in SECURITY.md.
Add fast-forward attack to specification
Remove simple-settings dependency
Move crypto-related code to external library (securesystemslib).
Allow replacement of already listed targets in metadata. Fix issue #319.
Add instructions for contributors in README.
Copy (rather than link) target file to consistent target. Fix issue #390.
Rename target() -> get_one_valid_targetinfo().
Ensure consistent Root is written if consistent snapshot = False. Fix issue #391.
repository_tool.status(): Print status of only the top-level roles.
Document and demonstrate protection against repository attacks.
Add installation instructions for Fedora-based environments.
Exclude "private" dict key from metadata.
"backtrack" attribute renamed to "terminating".
Fix data loss that might occur during sudden power failure. Pull requests #365, 367.
Add repository tool function that can mark roles as dirty.
Store all delegated roles in one flat directory.
Support Unix shell-style wildcards for paths listed in metadata.
Add draft of specification (version 1.0).
Sleep a short while during download.py while loop to release CPU.
Support multiple key ID hashing algorithms.
Prepend version number to filename of consistent metadata.
Remove updater method: refresh_targets_metadata_chain().
Add Diplomat paper. It covers integrating TUF with community repositories.
Add project logo.
Delegations now resemble a graph, rather than a tree.