Prototyping Support for Content Addressable Systems like IPFS in TUF
- Mentors
- Aditya Sirish A Yelgundhalli, Ericson2314
- Organization
- CNCF
- Technologies
- python
- Topics
- Secure Software Updation
The TUF specification provides explicit guidelines for how artifacts should be hashed and later verified to guarantee their integrity. However, Content Addressable Systems like Git, IPFS (InterPlanetary File System) and OSTree have their own mechanisms for ensuring the integrity of artifacts. When TUF is used with these systems, it is redundant for it to also ensure artifact integrity. This project provides solution to this issue by delegating the responsibility of artifact integrity verification to the underlying content addressable systems themselves, while still using TUF to manage the metadata and provide additional security measures.