Software updates and TUF
The Release Role
The release role is used to sign the metadata within the update system to ensure clients see a consistent state. This basically links up the signatures, the root keys, and the signed files into a cohesive package. Otherwise, an attacker could modify the metadata to cause you to download an older version, for example.
The Timestamp Role
The final role is the timestamp role, which is used to provide information on the availability of updates. Basically, you modify the timestamp file when a new update is ready and sign it to let clients know a new update is available. However, when an update is not available, how do clients know they aren't simply being fed an old version of the file? By re-signing the file frequently, the client will know that even though the file has not changed, it is still valid.
Typically, you want to re-sign the timestamp file daily – ideally, every few hours – so this activity should be automated. Again, if possible, this should be done on a server that is separate from the server on which files are then uploaded to become publicly available.
Why Metadata Matters
You might wonder why you should you be concerned about signing multiple files and metadata within the update system. Why not just create a new version of the software then sign and upload it? By supporting the signing of multiple separate files and using metadata to define updates, you can avoid situations in which your version of an application and a library cause a security vulnerability or simply don't work together. You can also prevent clients from updating a library, which then breaks the system. Additionally, this approach allows you to update separate components individually. Thus, for a large application that includes optional plugins, you can separate everything.
Buy this article as PDF
Customers can take a free test drive of SLES for HPC on the Azure Cloud
San Francisco-based chip company announces their first fully open source chip platform.
The whole distro gets rebuilt on glibc 2.3
Ubuntu Vendor tries to solve app packaging and distribution problem across distributions.
Founder of ownCloud launches the Nextcloud project.
Will The Machine change the way future programmers think about memory?
The new Torus distributed storage system is available under an open source license on GitHub
Juries decides Google’s use of Java APIs Was Fair Use
But if you are not using the latest Linux kernel, your system is insecure.
Home routers will give room for custom firmware but still comply with FCC rules