Software updates and TUF
The Release Role
The release role is used to sign the metadata within the update system to ensure clients see a consistent state. This basically links up the signatures, the root keys, and the signed files into a cohesive package. Otherwise, an attacker could modify the metadata to cause you to download an older version, for example.
The Timestamp Role
The final role is the timestamp role, which is used to provide information on the availability of updates. Basically, you modify the timestamp file when a new update is ready and sign it to let clients know a new update is available. However, when an update is not available, how do clients know they aren't simply being fed an old version of the file? By re-signing the file frequently, the client will know that even though the file has not changed, it is still valid.
Typically, you want to re-sign the timestamp file daily – ideally, every few hours – so this activity should be automated. Again, if possible, this should be done on a server that is separate from the server on which files are then uploaded to become publicly available.
Why Metadata Matters
You might wonder why you should you be concerned about signing multiple files and metadata within the update system. Why not just create a new version of the software then sign and upload it? By supporting the signing of multiple separate files and using metadata to define updates, you can avoid situations in which your version of an application and a library cause a security vulnerability or simply don't work together. You can also prevent clients from updating a library, which then breaks the system. Additionally, this approach allows you to update separate components individually. Thus, for a large application that includes optional plugins, you can separate everything.
Buy this article as PDF
Popular open source encryption tool is vulnerable to attack
New “Yakkety Yak” edition emphasizes cloud and servers
Google finally enters the phone hardware business.
Innovative system adds a hard drive and Ubuntu Core to the RPi for an IoT hub.
Linux is two weeks younger than we thought!
The Apache Software Foundation considers retiring OpenOffice
Adobe won’t kill the plugin in 2017
Linux Foundation's big event celebrates the 25th anniversary of Linux
Linux has evolved from “won’t be a professional” project to one of the most professional software projects in the history of computers.