Software Update Security for Humans: A gentle introduction

In this talk, Christopher Gervais explores The Update Framework (TUF), a standard developed to enhance supply chain security for open source projects, specifically in relation to Drupal's Automatic Updates initiative. The speaker discusses the challenges posed by software supply chains and how TUF aims to secure smaller Drupal sites, making it easier for diverse organizations to adopt the platform. Key topics include validating digital signatures, understanding asymmetric key-pairs, and the significance of signing software packages to prevent tampering during updates. This beginner-level session uses real-world examples to illustrate fundamental security concepts and their application in improving Drupal's security framework.