TUF, The Update Framework, is a set of libraries, file formats and utilities that let clients verify the keys and files they download. Sigstore uses a TUF trust root to hand clients the trusted keys and certificates needed to check Fulcio certificates and Rekor log entries.
The question TUF answers
Any signature check needs a starting point: which public keys do I trust? If an attacker can swap that starting set, every later check is worthless. TUF exists to make the distribution of trusted material itself resilient.
The TUF project describes three failure patterns it defends against: an attacker who keeps serving you the same file so you never see an update, an attacker who serves an older insecure version, and an attacker who compromises a signing key and produces a validly signed malicious file.
The four roles
TUF splits trust across roles, each with its own metadata file:
| Role | Job |
|---|---|
| Root | Names the other roles and lists their trusted keys and signature thresholds |
| Targets | Lists hashes and sizes of the files clients download, and can delegate |
| Snapshot | Lists versions or hashes of the targets metadata, so clients see one consistent view |
| Timestamp | Records the hash of the snapshot, re-signed often with a short expiry |
A threshold is the minimum number of listed keys that must sign. Key separation lets the riskier online keys, such as timestamp, stay apart from offline keys.
How Sigstore fits in
Sigstore's security documentation says its TUF root was established in a public key signing ceremony with five keyholders. It secures the keys that matter for verification: the Fulcio root certificate, which issues short-lived code signing certificates, and the keys for Rekor, the append-only transparency log.
When a verifier checks a keyless signature, it needs to know that the certificate chains to the real Fulcio root and that the log entry is signed by the real Rekor key. The TUF root is how a client learns both, and how it learns about rotations later.
What this means in practice
- Verification tools update their trust material from TUF, so keep tools current.
- A mismatch between the trust root and the Sigstore instance that signed produces an unknown authority style error. This is common when mixing public and private deployments.
- If you run a private Sigstore deployment, you also own the job of distributing its root safely.
Where Safeguard fits
Safeguard's asset discovery and SBOM scanning help you see which tools and dependencies in your estate you are trusting in the first place, which is the input to any trust root decision.
Quick check
Does TUF sign my artifacts?
No. TUF protects the distribution of trusted keys and metadata. In Sigstore it secures the roots that verification depends on, while cosign signs the artifacts.
What is a signature threshold?
It is the minimum number of a role's listed keys that must sign its metadata for clients to accept it.
Sources
Last reviewed: 19 October 2026.
