<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>I stumbled over this page: <a class="moz-txt-link-freetext" href="https://theupdateframework.github.io/">https://theupdateframework.github.io/</a><br>
<br>
I guess people interested in distutils might be interested in it.<br>
</p>
<p>For people too lazy to click on links (like me), I copy+paste the
content:<br>
<br>
</p>
<h1 id="a-framework-for-securing-software-update-systems">A
Framework for Securing Software Update Systems</h1>
<p>The Update Framework (TUF) helps developers to secure new or
existing
software update systems, which are often found to be vulnerable to
many
known attacks. TUF addresses this widespread problem by providing
a
comprehensive, flexible security framework that developers can
integrate
with any software update system. The framework can be easily
integrated (or
implemented in the native programming languages of these update
systems)
due to its concise, self-contained architecture and specification.
Developers have so far implemented the framework in the
<a href="https://github.com/theupdateframework/tuf">Python</a>,
<a href="https://github.com/flynn/go-tuf">Go</a>,
<a
href="https://corner.squareup.com/2013/12/securing-rubygems-with-tuf-part-1.html">Ruby</a>,
and
<a
href="https://www.well-typed.com/blog/2015/07/hackage-security-alpha/">Haskell</a>
programming languages.</p>
<h2 id="what-is-a-software-update-system">What is a software update
system?</h2>
<p>Generally, a software update system is an application (or part of
an
application) running on a client system that obtains and installs
software.
This can include updates to software that is already installed or
even
completely new software.</p>
<p>Three major classes of software update systems are:</p>
<ul>
<li>
<strong>Application updaters</strong> which are used by
applications use to update themselves. For example, Firefox
updates itself through its own application updater.</li>
<li>
<strong>Library package managers</strong> such as those offered
by many programming languages for installing additional
libraries. These are systems such as Python’s pip/easy_install +
PyPI, Perl’s CPAN, Ruby’s Gems, and PHP’s PEAR.</li>
<li>
<strong>System package managers</strong> used by operating
systems to update and install all of the software on a client
system. Debian’s APT, Red Hat’s YUM, and openSUSE’s YaST are
examples of these.</li>
</ul>
<h2 id="our-approach">Our approach</h2>
<p>There are literally thousands of different software update
systems in
common use today. (In fact the average Windows user has about two
dozen
different software updaters on their machine!)</p>
<p>We built a
<a
href="https://github.com/theupdateframework/tuf/blob/develop/docs/tuf-spec.md">specification</a>
and <a href="https://github.com/theupdateframework/tuf">library</a>
that can be
universally (and in most cases transparently) used to secure
software
update systems.</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="120">--
Thomas Guettler <a class="moz-txt-link-freetext" href="http://www.thomas-guettler.de/">http://www.thomas-guettler.de/</a>
I am looking for feedback: <a class="moz-txt-link-freetext" href="https://github.com/guettli/programming-guidelines">https://github.com/guettli/programming-guidelines</a></pre>
</body>
</html>