Tuf 0.5.0
dotnet add package Tuf --version 0.5.0
NuGet\Install-Package Tuf -Version 0.5.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Tuf" Version="0.5.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
<PackageVersion Include="Tuf" Version="0.5.0" />
<PackageReference Include="Tuf" />
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.
paket add Tuf --version 0.5.0
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
#r "nuget: Tuf, 0.5.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
#:package Tuf@0.5.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.
#addin nuget:?package=Tuf&version=0.5.0
#tool nuget:?package=Tuf&version=0.5.0
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
Tuf
A .NET implementation of The Update Framework (TUF) client for secure software update verification.
Overview
Tuf provides a standards-compliant TUF client that securely downloads and verifies metadata from a TUF repository. It handles the full metadata verification workflow including root rotation, timestamp/snapshot freshness checks, and signature validation.
Features
- TUF specification compliant — implements the client workflow from the TUF specification
- Secure root rotation — safely updates trust anchors across key rotations
- Metadata verification — validates signatures, expiration, and version consistency
- Pluggable caching — in-memory and file-system cache implementations included
- Pluggable repository — HTTP repository included, custom transports supported
- AOT-compatible — fully trimmer and NativeAOT safe
Quick Start
using Tuf;
// Create a TUF client with HTTP repository and file-system cache
var options = new TufClientOptions
{
RepositoryUri = new Uri("https://tuf-repo-cdn.sigstore.dev"),
Cache = new FileSystemTufCache("/path/to/cache")
};
var client = new TufClient(options);
// Refresh metadata (downloads and verifies latest metadata)
await client.RefreshAsync();
Documentation
License
MIT — see LICENSE.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.
-
net10.0
- NSec.Cryptography (>= 25.4.0)
NuGet packages (1)
Showing the top 1 NuGet packages that depend on Tuf:
| Package | Downloads |
|---|---|
|
Sigstore
A .NET library for generating and verifying Sigstore signatures. |
GitHub repositories (1)
Showing the top 1 popular GitHub repositories that depend on Tuf:
| Repository | Stars |
|---|---|
|
microsoft/aspire
Aspire is the tool for code-first, extensible, observable dev and deploy.
|