Changes between Initial Version and Version 1 of GIR2.1_SecureUpdates

Timestamp:

03/14/11 21:59:17 (13 years ago)

Author:

lnevers@bbn.com

Comment:

--

GIR2.1_SecureUpdates

@@ +1 @@
+== Secure Updates Evaluation ==
+
+Version evaluated was downloaded with Mercurial instructions from https://www.updateframework.com/wiki/Download.  
+{{{
+hg clone https://www.updateframework.com/hg/tuf/
+}}}
+The Update Framework (TUF) changeset version for downloaded is 11.
+
+The [https://www.updateframework.com TUF] page provided pointers to an 
+example [http://pypi.updateframework.com:81/ PyPI] repository mirror that 
+includes TUF metadata. The [https://www.updateframework.com TUF] page also 
+includes an attachment for an example 
+[https://www.updateframework.com/attachment/wiki/SecuringPythonPackageManagement/tuf_pypi_example.tar.gz TUF PyPI client].
+
+Time Frame: This evaluation took place on June 30, 2010.
+
+== Secure Updates Findings ==
+Instruction were clear and straight forward, and are found at the
+[https://www.updateframework.com/wiki/SecuringPythonPackageManagement TUF: The Update Framework] site.
+The enclosed README give a pointer to the TUF site.
+
+The example [http://pypi.updateframework.com:81/ PyPI repository mirror] was used to execute the run-time  
+commands, no repository was set up for this evaluation.
+
+One python path problem was encountered while trying to use the client which was resolved by unpacking the 
+client first and then getting TUF in the same directory. This is capture in the section below. 
+ 
+
+== Secure Updates How-to ==
+
+Trying to use the client ran into python path issues which were resolved
+by unpacking the client first and then getting TUF in the same directory:
+{{{
+lnevers@sendaria:~$ tar xvzf tuf_pypi_example.tar.gz
+lnevers@sendaria:~$ cd tuf_pypi_example
+lnevers@sendaria:~/tuf_pypi_example$ hg clone https://www.updateframework.com/hg/tuf/
+}}}
+
+Once the tuf repo is inside the tuf_pypi_example directory, one can get listings of packages
+{{{
+lnevers@sendaria:~/tuf_pypi_example$ ./tuf_pypi_client.py list 3to2
+[2010-06-30 11:15:02,519] [tuf] [INFO] Downloading http://pypi.updateframework.com:81/pypi/meta/timestamp.txt
+3to2-0.1a2.tar.gz
+3to2-0.1a3.tar.gz
+}}}
+and download a package
+{{{
+lnevers@sendaria:~/tuf_pypi_example$ ./tuf_pypi_client.py download 3to2-0.1a3.tar.gz   
+[2010-06-30 11:15:40,094] [tuf] [INFO] Downloading http://pypi.updateframework.com:81/pypi/meta/timestamp.txt
+[2010-06-30 11:15:40,329] [tuf] [INFO] Downloading http://pypi.updateframework.com:81/pypi/targets/3to2/3to2-0.1a3.tar.gz
+[2010-06-30 11:15:40,927] [tuf] [INFO] Correct hash: d48d764e781597644e8d41a83954cb62354c07d2c74abdd7e32e4d119d764636
+Downloaded file: 3to2-0.1a3.tar.gz
+}}}
+
+Here is an example of a package without any updates:
+
+{{{
+lnevers@sendaria:~/tuf_pypi_example$ ./tuf_pypi_client.py list neveredit
+[2010-06-30 11:20:20,567] [tuf] [INFO] Downloading http://pypi.updateframework.com:81/pypi/meta/timestamp.txt
+[2010-06-30 11:20:20,822] [tuf] [INFO] Metadata 'targets/n.txt' has changed
+[2010-06-30 11:20:20,822] [tuf] [INFO] Downloading http://pypi.updateframework.com:81/pypi/meta/targets/n.txt
+[2010-06-30 11:20:21,578] [tuf] [INFO] Metadata 'targets/n/neveredit.txt' has changed
+[2010-06-30 11:20:21,578] [tuf] [INFO] Downloading http://pypi.updateframework.com:81/pypi/meta/targets/n/neveredit.txt
+No files are available for package neveredit
+}}}