# theupdateframework/python-tuf

Python reference implementation of The Update Framework (TUF)

Repository: https://github.com/theupdateframework/python-tuf
Canonical: https://ross.abutalabs.com/products/python-tuf
Homepage: https://theupdateframework.com/
Language: Python
License: Apache-2.0
License Family: permissive
Topics: software, security, python, update, revocation, key, compromise, repository, cncf
Last push: 2026-08-25T13:30:46+00:00

## Health v2 (maintenance only)
Score: 83/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 52, longevity 100
- inputs: {"age_days": 4962, "days_push": 8, "days_rel": 107, "gap_med": 293.0, "n_releases_24m": 3}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1724, forks 302 (observed 2026-08-28T04:05:27.989561+00:00)

## What it is
Python reference implementation of The Update Framework (TUF), a CNCF-graduated specification for securing software update systems against repository and key compromise. It provides a low-level metadata API, a client updater library, and a repository library for creating and verifying signed TUF metadata.

## Use cases
- secure software update system against key compromise
- add TUF metadata signing to a package repository
- implement a TUF-compliant update client in Python
- protect against supply chain attacks on content delivery
- rotate signing keys and revoke compromised keys safely
- verify downloaded artifacts before installing updates

## When to choose
- you need a battle-tested, spec-conformant TUF implementation in Python
- you are building an application updater or package manager that must resist repository or key compromise
- you want a readable reference for implementing TUF in another language

## When to avoid
- you need a turnkey update server or signing service rather than a library
- your updater has no threat model beyond simple HTTPS downloads
- you need a TUF implementation in Go, Rust, or JavaScript instead

## Facets
- artifact type: library
- maturity: stable
- function: security, cryptography, sdk, serialization
- domain: security, developer-tools
- platform: python, cross-platform
- tags: tuf, software-updates, supply-chain-security, key-rotation, metadata-signing, cncf, secure-content-delivery, cryptography, automation

## Member repositories
- theupdateframework/python-tuf (main) score 83

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:27.989561+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:33:55.864616+00:00, confidence not recorded.
  - readme: https://github.com/theupdateframework/python-tuf (fetched 2026-08-28T04:05:27.989561+00:00, sha d5ae426b9a1b)
  - homepage: https://theupdateframework.com/ (fetched 2026-08-29T11:09:28.446674+00:00, sha bec5a6fce306)
  - site_page: https://theupdateframework.com/docs/contributing (fetched 2026-08-29T11:09:28.462294+00:00, sha bd28c4fe6d74)
  - site_page: https://theupdateframework.com/docs/getting-started (fetched 2026-08-29T11:09:28.460684+00:00, sha 8dca18961249)
  - site_page: https://theupdateframework.com/about (fetched 2026-08-29T11:09:28.455639+00:00, sha cf8d963ce2a8)
  - site_page: https://theupdateframework.com/docs (fetched 2026-08-29T11:09:28.457212+00:00, sha 341f99d0e491)
  - site_page: https://theupdateframework.com/docs/overview (fetched 2026-08-29T11:09:28.458692+00:00, sha 378eb6c81f81)
  - site_page: https://theupdateframework.com/docs/project/funding (fetched 2026-08-29T11:09:28.463979+00:00, sha a72149300475)
- Data as of 2026-08-30T08:39:29.467469+00:00.