Installation
All versions of python-tuf
can be installed from
PyPI with
pip.
python3 -m pip install tuf
By default tuf is installed as pure python package with limited cryptographic abilities. See Install with full cryptographic abilities for more options.
Install with full cryptographic abilities
Default installation supports signature verification only, using a pure Python
ed25519 implementation. While this allows to operate a basic client on
almost any computing device, you will need additional cryptographic abilities
for repository code, i.e. key and signature generation, additional
algorithms, and more performant backends. Opt-in is available via
securesystemslib
.
Note
Please consult with underlying crypto backend installation docs – cryptography and pynacl – for possible system dependencies.
python3 -m pip securesystemslib[crypto,pynacl] tuf
Install for development
To install tuf in editable mode together with development dependencies, clone the python-tuf repository from GitHub, change into the project root directory, and install with pip (using venv is recommended).
Note
Development installation will Install with full cryptographic abilities. Please check above for possible system dependencies.
python3 -m pip install -r requirements-dev.txt
Verify release signatures
Releases on PyPI are signed with a maintainer key using gpg (see MAINTAINERS.txt for key fingerprints). Signatures can be downloaded from the GitHub release page (look for *.asc files in the Assets section).
Below code shows how to verify the signature of a built distribution, signed by the maintainer Lukas Pühringer. It works alike for source distributions.
# Get wheel from PyPI and signature from GitHub
python3 -m pip download --no-deps tuf==0.20.0
wget https://github.com/theupdateframework/python-tuf/releases/download/v0.20.0/tuf-0.20.0-py3-none-any.whl.asc
# Get public key, compare fingerprint in MAINTAINERS.txt, and verify with gpg
gpg --recv-keys 89A2AD3C07D962E8
gpg --verify tuf-0.20.0-py3-none-any.whl.asc
# Output:
# gpg: assuming signed data in 'tuf-0.20.0-py3-none-any.whl'
# gpg: Signature made Thu Dec 16 09:21:38 2021 CET
# gpg: using RSA key 8BA69B87D43BE294F23E812089A2AD3C07D962E8
# gpg: Good signature from "Lukas Pühringer <lukas.puehringer@nyu.edu>" [ultimate]