Software updates and TUF
The Release Role
The release role is used to sign the metadata within the update system to ensure clients see a consistent state. This basically links up the signatures, the root keys, and the signed files into a cohesive package. Otherwise, an attacker could modify the metadata to cause you to download an older version, for example.
The Timestamp Role
The final role is the timestamp role, which is used to provide information on the availability of updates. Basically, you modify the timestamp file when a new update is ready and sign it to let clients know a new update is available. However, when an update is not available, how do clients know they aren't simply being fed an old version of the file? By re-signing the file frequently, the client will know that even though the file has not changed, it is still valid.
Typically, you want to re-sign the timestamp file daily – ideally, every few hours – so this activity should be automated. Again, if possible, this should be done on a server that is separate from the server on which files are then uploaded to become publicly available.
Why Metadata Matters
You might wonder why you should you be concerned about signing multiple files and metadata within the update system. Why not just create a new version of the software then sign and upload it? By supporting the signing of multiple separate files and using metadata to define updates, you can avoid situations in which your version of an application and a library cause a security vulnerability or simply don't work together. You can also prevent clients from updating a library, which then breaks the system. Additionally, this approach allows you to update separate components individually. Thus, for a large application that includes optional plugins, you can separate everything.
Buy this article as PDF
VMware bids for a stake in the container industry with a bold effort to integrate containers with its classic virtualization system.
3ROS attack tool lowers the technical bar so anyone can be an intruder.
Mozilla's latest browser offers powerful new privacy feature
If attackers are on your system, saving your passwords in a password vault is no protection.
Faulty hash algorithm persists, despite efforts by experts to raise awareness.
Powerful man-in-the-middle attack is now targeting online shopping.
Another high-profile coder says the kernel team needs a kinder, gentler culture.
Bug database has a bug of its own that could allow an intruder to create an unauthorized account.
Report focuses federal resources on achieving universal Internet access.
Leading browser makers say “no” to porous encryption algorithm