# TAF (The Archive Framework)
TAF is a framework that aims to provide archival authentication
and ensure that Git repositories can be securely cloned/updated. TAF's implementation
strongly relies on [The Update Framework (TUF)](https://theupdateframework.github.io),
which helps developers maintain the security of a software update system. It provides a
flexible framework and specification that developers can integrate into any software update
system. TAF integrates Git with TUF:
- TUF targets were modified to authenticate Git commits instead of individual files.
This reduces the metadata size and simplifies authentication.
- The TUF metadata repository storage utilizes Git. That means TUF metadata files are
stored in a Git repository, which is referred to as an authentication repository.
When a TAF authentication repository is cloned, all target repositories are also cloned, and
TUF validation is performed against every commit since the repository's inception. When a TAF
repository is updated, data is fetched from upstream and each commit is authenticated. A TAF
clone/update differs from a standard Git clone/fetch in that remote commits aren't added to the
local Git repositories until they've been fully authenticated locally. TAF can be used to secure
any git repository, regardless of its content.
## Threats
A git repository can be compromised in several ways:
- An attacker might hack a user's account on a code hosting platform, like GitHub or GitLab.
- An attacker might compromise the hosting platform itself.
- An attacker might gain access to a developer's personal computer.
Such an attacker could then:
- Upload a new GPG key to GitHub.
- Push new commits to any repository.
- Add another authorized user with write access.
- Unprotect the master branch of any repository and force-push to it.
TAF's primary objective is not to prevent the attacks listed above but rather to detect when
an attack has occurred and halt an update if necessary. Thus, TAF should be used instead of
directly calling `git pull` and `git clone`.
## Further reading
1. [UELMA whitepaper](whitepapers/UELMA-Open-Law-White-Paper.pdf)
1. [TAF implementation and integration with TUF](docs/updater/specification.md)
## Installation Steps
From _PyPI_
```bash
pip install taf
```
From source:
```bash
pip install -e .
```
Install extra dependencies when using _Yubikey_:
```bash
pip install taf[yubikey]
```
Add bash completion:
1. copy `taf-complete.sh` to user's directory
1. add `source ./taf-complete.sh` to `~/.bash_profile` or `~/.bashrc`
1. source `~/.bash_profile`
## Development Setup
We are using [pre-commit](https://pre-commit.com/) to run _black_ code formatter, _flake8_ and _bandit_ code quality checks,
as well as _Mypy_ static type checker.
```bash
pip install -e .[dev]
pip install -e .[test]
pre-commit install # registers git pre-commit hook
pre-commit run --all-files # runs code formatting and quality checks for all files
```
NOTE: For _Windows_ users: Open [settings.json](.vscode/settings.json) and replace paths.
## Running Tests
To run tests with mocked Yubikey:
```bash
pytest
```
To run tests with real Yubikey:
1. Insert **test** Yubikey
2. Run `taf setup_test_key`
WARNING: This command will import targets private key to signature slot of your Yubikey, as well as new self-signed x509 certificate!
3. Run `REAL_YK=True pytest` or `set REAL_YK=True pytest` depending on platform.
## Installing Wheels on Windows and MacOS
The newer versions of TAF do not require additional setup, and there are no platform-specific wheels needed. However, older versions required certain platform-specific DLLs, which the CI would copy to `taf/libs` before building a wheel. Therefore, it's important to install the appropriate platform-specific wheel if you're using an older version.
## Installing Wheels on Ubuntu
- Install dependencies
```bash
sudo add-apt-repository ppa:jonathonf/python-3.10
sudo apt-get update
sudo apt-get install python3.10
sudo apt-get install python3.10-venv
sudo apt-get install python3.10-dev
sudo apt-get install swig
sudo apt-get install libpcsclite-dev
sudo apt-get install libssl-dev
sudo apt-get install libykpers-1-dev
```
- Create virtual environment
```bash
python3.10 -m venv env
pip install --upgrade pip
pip install wheel
pip install taf
```
- Test CLI
```bash
taf
```
## Acknowledgements
This project was made possible in part by the Institute of Museum and Library Services [(LG-246285-OLS-20)](https://www.imls.gov/grants/awarded/lg-246285-ols-20)
Raw data
{
"_id": null,
"home_page": "https://github.com/openlawlibrary/taf/tree/master",
"name": "taf",
"maintainer": null,
"docs_url": null,
"requires_python": null,
"maintainer_email": null,
"keywords": "update updater secure authentication archival",
"author": "Open Law Library",
"author_email": "info@openlawlib.org",
"download_url": "https://files.pythonhosted.org/packages/73/c0/d2d353ed487cedbf071f3be68bc6d191ba4f64318c6d750399b2b73ff267/taf-0.33.0.tar.gz",
"platform": null,
"description": "# TAF (The Archive Framework)\n\nTAF is a framework that aims to provide archival authentication\nand ensure that Git repositories can be securely cloned/updated. TAF's implementation\nstrongly relies on [The Update Framework (TUF)](https://theupdateframework.github.io),\nwhich helps developers maintain the security of a software update system. It provides a\nflexible framework and specification that developers can integrate into any software update\nsystem. TAF integrates Git with TUF:\n\n- TUF targets were modified to authenticate Git commits instead of individual files.\n This reduces the metadata size and simplifies authentication.\n- The TUF metadata repository storage utilizes Git. That means TUF metadata files are\n stored in a Git repository, which is referred to as an authentication repository.\n\nWhen a TAF authentication repository is cloned, all target repositories are also cloned, and\nTUF validation is performed against every commit since the repository's inception. When a TAF\nrepository is updated, data is fetched from upstream and each commit is authenticated. A TAF\nclone/update differs from a standard Git clone/fetch in that remote commits aren't added to the\nlocal Git repositories until they've been fully authenticated locally. TAF can be used to secure\nany git repository, regardless of its content.\n\n## Threats\n\nA git repository can be compromised in several ways:\n\n- An attacker might hack a user's account on a code hosting platform, like GitHub or GitLab.\n- An attacker might compromise the hosting platform itself.\n- An attacker might gain access to a developer's personal computer.\n\nSuch an attacker could then:\n\n- Upload a new GPG key to GitHub.\n- Push new commits to any repository.\n- Add another authorized user with write access.\n- Unprotect the master branch of any repository and force-push to it.\n\nTAF's primary objective is not to prevent the attacks listed above but rather to detect when\nan attack has occurred and halt an update if necessary. Thus, TAF should be used instead of\ndirectly calling `git pull` and `git clone`.\n\n\n## Further reading\n\n1. [UELMA whitepaper](whitepapers/UELMA-Open-Law-White-Paper.pdf)\n1. [TAF implementation and integration with TUF](docs/updater/specification.md)\n\n## Installation Steps\n\nFrom _PyPI_\n\n```bash\npip install taf\n```\n\nFrom source:\n\n```bash\npip install -e .\n```\n\nInstall extra dependencies when using _Yubikey_:\n\n```bash\npip install taf[yubikey]\n```\n\nAdd bash completion:\n\n1. copy `taf-complete.sh` to user's directory\n1. add `source ./taf-complete.sh` to `~/.bash_profile` or `~/.bashrc`\n1. source `~/.bash_profile`\n\n## Development Setup\n\nWe are using [pre-commit](https://pre-commit.com/) to run _black_ code formatter, _flake8_ and _bandit_ code quality checks,\nas well as _Mypy_ static type checker.\n\n```bash\npip install -e .[dev]\npip install -e .[test]\n\npre-commit install # registers git pre-commit hook\n\npre-commit run --all-files # runs code formatting and quality checks for all files\n```\n\nNOTE: For _Windows_ users: Open [settings.json](.vscode/settings.json) and replace paths.\n\n## Running Tests\n\nTo run tests with mocked Yubikey:\n\n```bash\npytest\n```\n\nTo run tests with real Yubikey:\n\n1. Insert **test** Yubikey\n2. Run `taf setup_test_key`\n WARNING: This command will import targets private key to signature slot of your Yubikey, as well as new self-signed x509 certificate!\n3. Run `REAL_YK=True pytest` or `set REAL_YK=True pytest` depending on platform.\n\n\n## Installing Wheels on Windows and MacOS\n\nThe newer versions of TAF do not require additional setup, and there are no platform-specific wheels needed. However, older versions required certain platform-specific DLLs, which the CI would copy to `taf/libs` before building a wheel. Therefore, it's important to install the appropriate platform-specific wheel if you're using an older version.\n\n\n## Installing Wheels on Ubuntu\n\n\n- Install dependencies\n\n```bash\nsudo add-apt-repository ppa:jonathonf/python-3.10\nsudo apt-get update\nsudo apt-get install python3.10\nsudo apt-get install python3.10-venv\nsudo apt-get install python3.10-dev\nsudo apt-get install swig\nsudo apt-get install libpcsclite-dev\nsudo apt-get install libssl-dev\nsudo apt-get install libykpers-1-dev\n```\n\n- Create virtual environment\n\n```bash\npython3.10 -m venv env\npip install --upgrade pip\npip install wheel\npip install taf\n```\n\n- Test CLI\n\n```bash\ntaf\n```\n\n\n## Acknowledgements\n\nThis project was made possible in part by the Institute of Museum and Library Services [(LG-246285-OLS-20)](https://www.imls.gov/grants/awarded/lg-246285-ols-20)\n",
"bugtrack_url": null,
"license": null,
"summary": "Implementation of archival authentication",
"version": "0.33.0",
"project_urls": {
"Homepage": "https://github.com/openlawlibrary/taf/tree/master"
},
"split_keywords": [
"update",
"updater",
"secure",
"authentication",
"archival"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "edb26d00ffd0b68c28b79f306ebfde67a65e7561529ca2552cbbab9b0a507bd2",
"md5": "32c1f4f31850b6aaeac288b5c4538ea5",
"sha256": "036cd0271747e0e1497a7b04832a0c0d2eca7f4e2991123c48e933d4d776600e"
},
"downloads": -1,
"filename": "taf-0.33.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "32c1f4f31850b6aaeac288b5c4538ea5",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": null,
"size": 243095,
"upload_time": "2024-12-23T20:09:21",
"upload_time_iso_8601": "2024-12-23T20:09:21.253733Z",
"url": "https://files.pythonhosted.org/packages/ed/b2/6d00ffd0b68c28b79f306ebfde67a65e7561529ca2552cbbab9b0a507bd2/taf-0.33.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "73c0d2d353ed487cedbf071f3be68bc6d191ba4f64318c6d750399b2b73ff267",
"md5": "4fd440f33d95256ea86e8aae2c6287bd",
"sha256": "a722bbb417912cfae467258243c1dc62e735c4794c0339146adb4cef48be4bfd"
},
"downloads": -1,
"filename": "taf-0.33.0.tar.gz",
"has_sig": false,
"md5_digest": "4fd440f33d95256ea86e8aae2c6287bd",
"packagetype": "sdist",
"python_version": "source",
"requires_python": null,
"size": 149562,
"upload_time": "2024-12-23T20:09:22",
"upload_time_iso_8601": "2024-12-23T20:09:22.831023Z",
"url": "https://files.pythonhosted.org/packages/73/c0/d2d353ed487cedbf071f3be68bc6d191ba4f64318c6d750399b2b73ff267/taf-0.33.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-12-23 20:09:22",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "openlawlibrary",
"github_project": "taf",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"lcname": "taf"
}
JSON
