go-tuf

I recently implemented a software updating system using [The Update Framework](https://theupdateframework.io/) directly, with [go-tuf](https://github.com/theupdateframework/go-tuf). It required a lot of design work around how we were going to do package management on top of using it for a secure updating system. This was due to TUF's designing around the capability for existing package management systems to adopt it and integrate it into their system. So TUF is very unopinionated and flexible. Given how TUF made it particularly hard to implement a system from scratch... How was your experience using Sigstore? Is it designed more around building systems from scratch? I.E. Is it more opinionated? Thanks.

Actually, we store the passwords inside the PEM file itself, which is encrypted by TUF [0]. > If you can store the password securely can you not then also store the private keys securely? You don't have to store the private keys securely. On the contrary, you can store your private keys publicly, if the decryption password strong enough. If you want to decrypt keys in the pipeline, of course your decryption keys still need to be stored securely. Which is why I added some KMS providers in the use-case diagram. [1] [0] https://github.com/theupdateframework/go-tuf/blob/master/enc... [1] https://raw.githubusercontent.com/Dentrax/cocert/main/.res/u...

While this article does do a good job of illuminating the potential challenges, it's a bit frustrating that there's such scant discussion of solutions. IMO, this problem has been solved pretty comprehensively by the TUF framework[1], which has a number of solid implementations[2][3]. Many of these implementations even have reliable third-party reviews, so should be pretty trustworthy. [1]: https://theupdateframework.github.io/ [2]: https://github.com/flynn/go-tuf [3]: https://github.com/theupdateframework/notary

There is also a BSD-licensed version that we wrote in Go: https://github.com/flynn/go-tuf

Yeah, I realize that depending on your toolchain it's not easily accessible. Ideally there would be a first-class implementation for each platform, but it looks like app stores are where we are headed. Though, that still leaves *nix package distribution, container images, language/framework and packaging as areas that can be helped by TUF. We (Flynn) actually have a Go[0] implementation that you could use to either make a separate updater binary or even compile it into your app using the new alternative build modes coming in Go 1.5[1]. Our implementation also includes some tools to manage the metadata and signing so that you don't have to manually build it. [0] https://github.com/flynn/go-tuf [1] https://tip.golang.org/doc/go1.5#link