Implementation of archival authentication
TAF (The Archive Framework) is an implementation of archival authentication. In other words, TAF ensures that a git repository can be securely cloned/updated and authenticated. In our case, a git repository is a collection of thousands of XML documents and represents a Library of official legal material, but TAF can be used to secure any git repository, regardless of its content.
A git repository can be compromised in a number of ways:
- an attacker could hack a user's account on a code hosting platform, like GitHub or GitLab,
- an attacker could hack the hosting platform,
- an attacker could gain access to a developer's personal computer.
This attacker could then:
- upload a new GPG key to GitHub,
- push new commits to any repository,
- add another authorized user with write access,
- unprotected the master branch of any of the repositories and force push to it.
TAF's goal is not to prevent any of the attacks listed above from happening, but to detect that an attack took place and cancel an update if that is the case. So, TAF should be used instead of directly calling
git pull and
TAF's implementation strongly relies on The Update Framework (TUF), which helps developers maintain the security of a software update system and provides a flexible framework and specification that developers can adopt into any software update system.
pip install taf
pip install -e .
Install extra dependencies when using Yubikey:
pip install taf[yubikey]
We are using pre-commit to run black code formatter, flake8 and bandit code quality checks.
pip install -e .[dev] pip install -e .[test] pre-commit install # registers git pre-commit hook pre-commit run --all-files # runs code formatting and quality checks for all files
NOTE: For Windows users: Open settings.json and replace paths.
To run tests with mocked Yubikey:
To run tests with real Yubikey:
- Insert test Yubikey
taf setup_test_yubikeyWARNING: This command will import targets private key to signature slot of your Yubikey, as well as new self-signed x509 certificate!
set REAL_YK=True pytestdepending on platform.
- Open https://dev.azure.com/openlawlibrary/TAF/_build
- Click on latest build
- Open Summary tab
- Under Build artifacts published, click on *wheels to download zip
Building Wheels on Ubuntu 16.04 and 18.04
Binary wheels exists only for macOS, windows-32bit and windows-64bit platforms for python 3.6!
- Install dependencies
sudo add-apt-repository ppa:jonathonf/python-3.6 sudo apt-get update sudo apt-get install python3.6 sudo apt-get install python3.6-venv sudo apt-get install python3.6-dev sudo apt-get install swig sudo apt-get install libpcsclite-dev sudo apt-get install libssl-dev sudo apt-get install libykpers-1-dev
- Create virtual environment
python3.6 -m venv env pip install --upgrade pip pip install wheel pip install taf
- Test CLI
|Filename, size||File type||Python version||Upload date||Hashes|
|Filename, size taf-0.2.2-cp36-cp36m-macosx_10_13_x86_64.whl (2.4 MB)||File type Wheel||Python version cp36||Upload date||Hashes View hashes|
|Filename, size taf-0.2.2-cp36-cp36m-win32.whl (2.6 MB)||File type Wheel||Python version cp36||Upload date||Hashes View hashes|
|Filename, size taf-0.2.2-cp36-cp36m-win_amd64.whl (2.7 MB)||File type Wheel||Python version cp36||Upload date||Hashes View hashes|
|Filename, size taf-0.2.2.tar.gz (1.7 MB)||File type Source||Python version None||Upload date||Hashes View hashes|
Hashes for taf-0.2.2-cp36-cp36m-macosx_10_13_x86_64.whl
Hashes for taf-0.2.2-cp36-cp36m-win_amd64.whl