The Update Framework Reviews

Anchore Reviews

The Update Framework mentions (4)

• Securing CI/CD Images with Cosign and OPA

  The Update Framework (TUF): TUF is a framework, not a tool, designed to enhance the security of software update systems. It focuses on resilience against key compromises and attacks, employing verifiable records to verify the authenticity of update files. TUF's flexibility and integration ease make it a foundational element in securing software updates, though it's not a direct image signing tool like the others. - Source: dev.to / 7 months ago

• US military to unleash thousands of autonomous war robots over next 2 years

  Here’s to hoping they employ some security to prevent the machines from being hacked and attacking our own infra ala TUF (https://theupdateframework.io/) or the tech from Foundries.io. - Source: Hacker News / 10 months ago

• An Overview of Kubernetes Security Projects at KubeCon Europe 2023

  Release signing—or attestation—was a hot topic at KubeCon among vendors, with many offering their own solutions. One in particular that stood out was CNCF’s recently graduated The Update Framework (TUF). - Source: dev.to / about 1 year ago

• Self Updating Binary

  One of the other solution for signature and handling their upgrade is https://theupdateframework.io/ . Haven't come around implementing it yet, but it sounds like a robust solution to this problem. Have you looked at it before? Source: over 1 year ago

Anchore mentions (5)

• An Overview of Kubernetes Security Projects at KubeCon Europe 2023

  Syft is a popular open source CLI tool created by Anchore for generating an SBOM from container images and filesystems. It’s designed to provide a catalog of dependencies for other tools to use as a data source. It supports many popular programming languages, package managers, and container image formats. - Source: dev.to / about 1 year ago

• SBOM management

  I saw https://fossa.com/ and https://anchore.com/ which seem to solve what I have in mind but I wanted to know if there's maybe an open source way of getting a better overview besides running trivy sbom everytime I want to know something about a given sbom file. Source: almost 2 years ago

• 🛡️ Docker image security scan automation with GH issues

  For docker image scan, we rely on the Container Scan (GitHub Action) maintained by Anchore. - Source: dev.to / about 2 years ago

• About Java Bytecode, native binaries & security (short Grype benchmark)

  Fortunately anchore provides a set of ready to use tools that helps... a lot :. - Source: dev.to / about 2 years ago

• Security Vulnerability Scanning for Scala

  I use sbt-dependency-check and https://anchore.com/ too to scan my docker images. The results are loaded into sonar-scanner as a step in my CI pipeline. Source: about 3 years ago