Package: taf
TAF (The Archive Framework)TAF is a framework that aims to provide archival authentication
and ensure that Git repositories can be securely cloned/updated. TAF's implementation
strongly relies onThe Update Framework (TUF),
which helps developers maintain the security of a software update system. It provides a
flexible framework and specification that developers can integrate into any software update
system. TAF integrates Git with TUF:TUF targets were modified to authenticate Git commits instead of individual files.
This reduces the metadata size and simplifies authentication.The TUF metadata repository storage utilizes Git. That means TUF metadata files are
stored in a Git repository, which is referred to as an authentication repository.When a TAF authentication repository is cloned, all target repositories are also cloned, and
TUF validation is performed against every commit since the repository's inception. When a TAF
repository is updated, data is fetched from upstream and each commit is authenticated. A TAF
clone/update differs from a standard Git clone/fetch in that remote commits aren't added to the
local Git repositories until they've been fully authenticated locally. TAF can be used to secure
any git repository, regardless of its content.ThreatsA git repository can be compromised in several ways:An attacker might hack a user's account on a code hosting platform, like GitHub or GitLab.An attacker might compromise the hosting platform itself.An attacker might gain access to a developer's personal computer.Such an attacker could then:Upload a new GPG key to GitHub.Push new commits to any repository.Add another authorized user with write access.Unprotect the master branch of any repository and force-push to it.TAF's primary objective is not to prevent the attacks listed above but rather to detect when
an attack has occurred and halt an update if necessary. Thus, TAF should be used instead of
directly callinggit pullandgit clone.Further readingUELMA whitepaperTAF implementation and integration with TUFInstallation StepsFromPyPIpipinstalltafFrom source:pipinstall-e.Install extra dependencies when usingYubikey:pipinstalltaf[yubikey]Add bash completion:copytaf-complete.shto user's directoryaddsource ./taf-complete.shto~/.bash_profileor~/.bashrcsource~/.bash_profileDevelopment SetupWe are usingpre-committo runblackcode formatter,flake8andbanditcode quality checks,
as well asMypystatic type checker.pipinstall-e.[dev]pipinstall-e.[test]pre-commitinstall# registers git pre-commit hookpre-commitrun--all-files# runs code formatting and quality checks for all filesNOTE: ForWindowsusers: Opensettings.jsonand replace paths.Running TestsTo run tests with mocked Yubikey:pytestTo run tests with real Yubikey:InserttestYubikeyRuntaf setup_test_keyWARNING: This command will import targets private key to signature slot of your Yubikey, as well as new self-signed x509 certificate!RunREAL_YK=True pytestorset REAL_YK=True pytestdepending on platform.Platform-specific WheelsOpenhttps://dev.azure.com/openlawlibrary/TAF/_buildClick on latest buildOpenSummarytabUnderBuild artifacts published, click on *wheels to download zipMore info indevops document.Building Wheels on Ubuntu 16.04 and 18.04Binary wheels exists only for macOS, windows-32bit and windows-64bit platforms for python 3.10!Install dependenciessudoadd-apt-repositoryppa:jonathonf/python-3.10
sudoapt-getupdate
sudoapt-getinstallpython3.10
sudoapt-getinstallpython3.10-venv
sudoapt-getinstallpython3.10-dev
sudoapt-getinstallswig
sudoapt-getinstalllibpcsclite-dev
sudoapt-getinstalllibssl-dev
sudoapt-getinstalllibykpers-1-devCreate virtual environmentpython3.10-mvenvenv
pipinstall--upgradepip
pipinstallwheel
pipinstalltafTest CLItafAcknowledgementsThis project was made possible in part by the Institute of Museum and Library Services(LG-246285-OLS-20)