python-tuf
Radar: Initial
Apache-2.0
The Python reference implementation of The Update Framework — secures software update systems against key compromise, rollback and freeze attacks.
The Update Framework
Specifications it implements
What this tool does to each specification, in the role vocabulary. Follow a standard through to standards.apievangelist.com for what it actually specifies.
| Standard | Role | What that means |
|---|---|---|
| The Update Framework | verifies |
The reference implementation. |
Using this from an agent
- Interfaces
librarycli- Install
-
pypi
tuf - Consumes
- tuf-metadata
- Runtime
- Needs network Deterministic Writes Needs credentials
Where it applies
Jobs this tool actually does, and the surface each one is exercised on.
Secure an update channel so a compromised signing key cannot push arbitrary software.
coding-agent
TUF's premise is that keys WILL be compromised, and the system should survive it. That is a different design goal from ordinary code signing.
- Website
- https://theupdateframework.com/
- Repository
- https://github.com/theupdateframework/python-tuf
- License
- Apache-2.0 — reported by the GitHub API, verified 2026-09-17
- Stars
- 1727 · last commit 2026-09-15
Reading this as an agent? Don't scrape the page — this entry is published as
structured data at
arrow_back
All tools by adoption
/tools.json,
against the tool.schema.json
schema, using the roles.json
vocabulary. Start at /llms.txt.