TUF Update Security Depends on Clients Enforcing Its Trust State

The Update Framework treats software repositories as potentially hostile, so it does not assume mirrors or CDNs will serve the newest or intended files. It uses signed metadata roles and defines checks that updaters must carry out, guarding against rollback, freeze, and mix-and-match attacks. Protection holds only when key custody is separated, such as keeping the root key offline and rotating keys through a planned path. Clients must persist their highest trusted version and expiration state, and reject expired timestamp metadata rather than treating a silent mirror as proof of no update. Operators should also validate file lengths and hashes, bound download sizes, and carefully review delegations to avoid overly broad authorization.