Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LFX: Add TUF project for Term 01 #1340

Merged
merged 1 commit into from
Feb 4, 2025
Merged

LFX: Add TUF project for Term 01 #1340

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions programs/lfx-mentorship/2025/01-Mar-May/project_ideas.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -536,3 +536,20 @@ find requirements from https://github.com/WebAssembly/component-model/tree/main/
- Amy Super (@amy-super, [email protected])
- Andrej Kiripolsky (@AndrejKiri, [email protected])
* Upstream Issue: https://github.com/prometheus/prometheus/issues/15909

#### TUF
##### Metadata Repository Visualization

A [TUF](https://theupdateframework.com/) metadata repository consists of signed metadata files, which are read by TUF clients when securely downloading artifacts. The [metadata](https://theupdateframework.com/docs/metadata/) contains information about the artifacts and about the metadata itself, most notably, who is trusted to sign what.

A suitable visual representation of this trust hierarchy makes TUF's security properties more accessible to end-users, and, more importantly, allows metadata signers to carefully review metadata changes before signing them.

In this project you will, together with your mentor and the TUF community, identify requirements for the visualization of a TUF metadata repository and build a corresponding web app.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Something I forgot when we we discussed this: I think the focus on "web app" is probably correct (considering the need to make the proposal tangible)...

That said, one of the difficulties in tuf-on-ci has been that there are two use cases with different technical limitations:

  • We want the repository state (who the signers are, when will signatures expire, what are the current artifact hashes) to be highly visible to the community: A website makes sense here even if it sidesteps some TUF security protections
  • But we also want the signers to only trust the information given by their signing tool (code running on their machine): they should not make decisions based on content of a website. Currently signing tools are all command line apps

If there's a way to improve both use cases, that would be great.


- Expected Outcome: Identify requirements and build a basic web app to visualize TUF metadata. *(Initial requirements may be inspired by the `tuf-on-ci` use case.)*
- Recommended Skills: Front-end web development, Information Visualization
- Mentor(s): #
- Lukas Pühringer (@lukpueh, [email protected]) - primary
- TBD
- Upstream Issue (URL): TBD, https://github.com/theupdateframework/tuf-on-ci/issues/39 (initial ideas)