Uptane is a secure software update framework for ground vehicles. It uses two repositories that must agree, signed metadata with four roles, and checks done by the vehicle's own control units. The aim is to make a compromise harder and recovery faster. It is implementation agnostic, so teams choose their own technology within its rules.
The two repositories
The image repository holds binary images and signed metadata about them. People control it mostly, and it changes rarely. Writes need authorization, and each upload is checked against a delegation chain.
The director repository works with a private inventory of vehicles and control units. It is mostly automated, signs metadata on demand and tells each unit which images to install. It receives version manifests from vehicles.
Requiring both to agree is the central idea. An attacker who compromises one of them cannot, by that alone, make a vehicle accept a bad image.
Primary and secondary units
A primary unit gets the time, downloads and verifies metadata and images, and hands them to its secondaries. It also sends the vehicle's installed software manifest to the director. A secondary unit receives those items from its primary and reports signed information about what it has installed.
Four signing roles
- Root distributes and revokes keys.
- Targets describes images.
- Snapshot ties the Targets versions together.
- Timestamp signals whether anything new exists.
Delegations let signing responsibility be split among parties, so one compromised key need not compromise the system. Delegations exist only on the image repository.
What it defends against
The standard lists attacker goals as reading updates, blocking updates, disrupting units and taking control of them. It assumes attackers can intercept network traffic or vehicle buses, compromise either repository but not both, and compromise a primary or a secondary but not both in one vehicle.
What it does not cover
The standard states several items as out of scope: physical tampering, malicious packaged software, supply chain compromise, OBD and UDS communication security, and malicious package mirrors. Uptane secures delivery. It cannot tell you that the code you signed was safe to ship. That is a job for your build and dependency controls.
If you are choosing an update design, read the standard, then check how a candidate implementation maps to its roles. The post on full versus partial verification covers the biggest design choice for small control units.
Is it worth adopting?
The standard asks for real engineering effort: key management for four roles, two repositories and verification on control units. It pays off where update compromise would be severe, which is true for most vehicles. If you already run update servers, map your current design to the roles and see which threats from the standard you do not cover today.
Quick check
Does Uptane replace signing and review in your build pipeline?
No. It protects delivery and recovery. Supply chain compromise before signing is outside its scope.
Sources
Last reviewed: 19 October 2026.
