Ditching OpenPGP, a new approach to signing APT repositories

Re:Ditching OpenPGP, a new approach to signing APT repositories by arkadiyt on Monday June 21, 2021 @11:19PM (#27587577)

> I disagree that TUF is too complicated for most projects. While our documentation, tutorials, and tooling can be better, the setup is about just as complicated as ...

I've heard great things about TUF but if you want people to adopt it then it seems like the documentation/tutorials/tooling should be a first class citizen

[ Parent | on HN ]

Re:Ditching OpenPGP, a new approach to signing APT repositories by joshuagl on Tuesday June 22, 2021 @06:44AM (#27590030)

Thanks for your comment. I completely agree, and we are working on it. If you have any suggestions for documentation/tutorials/tooling you would like to see, I'd be happy to add them to the list.

We are actively working to improve reference implementation, to make it easier to maintain (easier to read code, type annotations, generally more Pythonic, cleaner design) and use (cleaner documented API, easier to plug in your own implementation of things a content update system might already have an opinionated implementation of -- i.e. the network communication stack).

We hope to build more tools on top of the cleaned up reference implementation once it is feature complete.

For the specification itself, we recently switched to publishing a rich HTML document with cross-linking, syntax highlighting, ToC, etc. https://theupdateframework.github.io/specification/latest/ and added a new section covering some of the repository operations https://theupdateframework.github.io/specification/v1.0.19/#...

[ Parent | on HN ]