The Update Framework, or TUF, is a way to distribute updates so that clients can detect more than a bad signature. It protects against hiding updates, rollback to older files, offering a file that is newer but not the latest, and signing malicious files with a stolen key.
Four attacks it names
The TUF overview lists these threats:
- Stale updates hidden from you. An attacker keeps serving the same file, so you never learn an update exists.
- Rollback. An attacker offers an older, insecure file disguised as newer.
- Newer but not newest. An attacker offers a file that is newer than yours but not the latest, and may be exploitable.
- Compromised signing keys. An attacker signs malicious files with a stolen key so they pass signature checks.
A plain signed file protects against none of the first three, because each one uses real signed content.
How it works at a high level
TUF adds metadata containing trusted signing keys, file hashes, signatures, version numbers and expiration dates. Clients check downloaded target files against this metadata, which they also download from the repository. Expiry dates give the client a way to notice a repository that has stopped updating, and version numbers give a way to notice a rollback.
The project says it was designed to build resilience against key compromises and to minimise their impact. The overview page does not explain the mechanism, so read the specification for role details before you design around it.
Why it fits firmware
A device in the field is a long lived client that cannot be assumed to be online all the time or running the latest software. Those are the cases where stale and rollback attacks matter. ETSI EN 303 645 asks for updates to be verified for authenticity and integrity, and gives an anti-rollback policy as one measure. TUF is one structured way to get there for the update channel.
Limits to keep in mind
- TUF protects the delivery of files. The device still needs secure boot and verification of what it installs.
- Constrained devices may not be able to run the full client. ETSI notes that verification can be done by a trusted hub on limited devices.
- Operational work remains: key custody, offline signing, expiry refresh and a plan for recovery.
How to evaluate it for your product
Write down which of the four attacks your current update path survives. If you have a signature only, you probably survive the last one only partly and none of the others. Then decide whether to adopt an existing framework or to implement the same ideas, such as version checks and expiry, in your own protocol.
Quick check
Is TUF a replacement for secure boot?
No. It secures how updates are delivered and chosen. Secure boot verifies what the device runs.
Does a signed update stop a rollback attack?
Not by itself. An old file still carries a valid signature unless version checks or metadata expiry prevent it.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, policies and gates, and compliance evidence automation. Feed it the SBOMs and manifests your build produces and use gates to hold a release that fails your rules. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
