gittuf – security layer for Git repositories

gittuf is a security layer for Git repositories. It lets repository maintainers define policies controlling who is trusted to make changes to branches, tags, files and other repository namespaces.

The software is platform-agnostic. Its security controls are not tied to GitHub, GitLab, Bitbucket or another forge, allowing developers who can pull a repository to independently verify that changes followed its security policy.

gittuf uses cryptographic signatures to authenticate actors and maintains a Reference State Log that records changes to Git references. It can also use in-toto attestations to record repository activity such as code review approvals.

This is free and open source software.

Key Features

• Define write access policies for Git branches, tags and files.
• Independently verify that repository changes comply with security policies.
• Platform-agnostic design that works independently of the Git forge.
• Cryptographic authentication of repository actors.
• Root of trust and policy key management inspired by The Update Framework (TUF).
• Reference State Log records changes made to Git references.
• Supports policy rules requiring trusted developers to authorise changes.
• Supports GPG keys, SSH keys and Sigstore identities.
• Supports in-toto attestations for repository activity.
• Synchronises gittuf policy and Reference State Log metadata with remote repositories.
• Can be used with new or existing Git repositories.

Website: github.com/gittuf/gittuf
Support:
Developer: gittuf
License: Apache License 2.0

gittuf is written in Go. Learn Go with our recommended free books and free tutorials.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.