SIsimonpure·Sep 9, 2020Submission
The Update Framework Specification
2 points · Open discussiontheupdateframework
specification
Python2019–2020
theupdateframework / specification
specification
The Update Framework specification
2Distinct people
3Mentions
0Explicit recommenders
411GitHub stars
What to know before exploring
What it is
The Update Framework specification
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:01:02 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month3 dated mentions
Observed mentions: 2019-02-17 18:39:30 UTC to 2020-09-09 14:43:50 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Feb 2019 | 2019-02-01 00:00:00 UTC | 2019-03-01 00:00:00 UTC | 1 | 0 | 1 |
| Mar 2019 | 2019-03-01 00:00:00 UTC | 2019-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2019 | 2019-04-01 00:00:00 UTC | 2019-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2019 | 2019-05-01 00:00:00 UTC | 2019-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2019 | 2019-06-01 00:00:00 UTC | 2019-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2019 | 2019-07-01 00:00:00 UTC | 2019-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2019 | 2019-08-01 00:00:00 UTC | 2019-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2019 | 2019-09-01 00:00:00 UTC | 2019-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2019 | 2019-10-01 00:00:00 UTC | 2019-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2019 | 2019-11-01 00:00:00 UTC | 2019-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2019 | 2019-12-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2020 | 2020-01-01 00:00:00 UTC | 2020-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2020 | 2020-02-01 00:00:00 UTC | 2020-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2020 | 2020-03-01 00:00:00 UTC | 2020-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2020 | 2020-04-01 00:00:00 UTC | 2020-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2020 | 2020-05-01 00:00:00 UTC | 2020-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2020 | 2020-06-01 00:00:00 UTC | 2020-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2020 | 2020-07-01 00:00:00 UTC | 2020-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2020 | 2020-08-01 00:00:00 UTC | 2020-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2020 | 2020-09-01 00:00:00 UTC | 2020-10-01 00:00:00 UTC | 2 | 1 | 1 |
What Hacker News says
2 sourcesEstimates of prevalence do assume detection. How would we detect that a dependency that was installed a few deployments and reboots ago was compromised?
How does the classic infosec triad (Confidentiality, Integrity, Availability) apply to software supply chain security?
Confidentiality: Presumably we're talking about open source projects; which aren't confidential. Projects may request responsible disclosure in an e.g. security.txt; and vuln reports may be confidential for at least a little while.
Integrity: Secure transport protocols, checksums, and cryptographic code signing are ways to mitigate data integrity risks. GitHub supports SSH, 2FA, and GPG keys. Can all keys in the package signature keyring be used to sign any package? Can we verify a public key over a different channel? When we specify exact versions of software dependencie
Read the rest
s, can we also record package hashes which the package installer(s) will verify?
Availability: What are the internal and external data, network, and service dependencies for the development and deployment DevSecOps workflows? Can we deploy from local package mirrors? Who is responsible for securing and updating local package mirrors? Are these service dependencies all HA? Does everything in this system also depend upon the load balancer? Does our container registry support e.g. Docker Notary (TUF)? How should we mirror TUF package repos?
See also: "Guidance for [[transparent] proxy cache] partial mirrors?" https://github.com/theupdateframework/specification/issues/1...