SOSS Community Day Europe 2024

As part of OpenSSF, led by the Securing Software Repositories Working Group, one of the goals has been securing content distribution. The Update Framework (TUF) has been a prime reference for secure content delivery and updates for many years. Despite its popularity, integrating with existing repositories remains challenging. Repository Service for TUF (RSTUF) is the first project to implement a generic TUF application to make general TUF adoption easier for any content repository. Lately, as a recognition of the progress, RSTUF was promoted as an "incubating" project. In this talk, we will present RSTUF and update you with all the latest news about the project and how to secure content distribution by sharing use cases: - How PyPI and RubyGens are adopting RSTUF to secure their package repositories - RSTUF securing private repositories - Archivista, a storage for in-toto attestation secured by RSTUF