Repository Service for TUF

https://repository-service-tuf.readthedocs.io/en/stable/
Admin
Repository Service for TUF (RSTUF) is a collection of components that implement The Update Framework...
Tokens:67,605
Snippets:260
Trust Score:8.3
Update:1 year ago
Show doc for...
Tokens:
Raw
### RSTUF CLI for Ceremony and Bootstrap

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/setup

The RSTUF Command Line Interface (CLI) offers an interactive guided process for the Ceremony and Bootstrap, which are essential one-time setup steps for the RSTUF service. Ensure RSTUF CLI is installed before proceeding.

```APIDOC
RSTUF CLI:
  Ceremony and Bootstrap
    Description: Provides an interactive guided process for the Ceremony and Bootstrap setup of the RSTUF service.
    Prerequisites: RSTUF CLI must be installed. See Installation guide.
    Note: This is a one-time process. Do not run again if already completed during deployment.
    Related Commands: Ceremony (interactive guide)
```

--------------------------------

### Start Minikube and Enable Ingress

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/quick-start

Starts a Minikube cluster using Docker as the driver and enables the ingress and ingress-dns addons for network access.

```shell
❯ minikube start --driver=docker
❯ minikube addons enable ingress
❯ minikube addons enable ingress-dns
```

--------------------------------

### Repository Service for TUF CLI Installation

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/repository-service-tuf-cli/index

Instructions for installing the Repository Service for TUF CLI using pip.

```bash
pip install repository-service-tuf
```

--------------------------------

### RSTUF API Docker Getting Started and Prerequisites

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/repository-service-tuf-api/Docker_README

Details the initial setup requirements for running the RSTUF API service using Docker. It emphasizes the need for Docker installation and specifies the necessity of compatible broker and result backend services for Celery, recommending RabbitMQ or Redis.

```APIDOC
Getting Started
These instructions will cover usage information and for the docker container
Prerequisities
In order to run this container you’ll need docker installed.
Some required services:
  * repository-service-tuf-worker
  * Compatible Borker and Result Backend Service with Celery. Recomended: RabbitMQ or Redis
```

--------------------------------

### RSTUF CLI Configuration Example

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Example configuration for the RSTUF CLI, specifying repository details and server URLs.

```yaml
REPOSITORIES:
    myrepo:
        artifact_base_url: http://127.0.0.1:8081
        hash_prefix: false
        metadata_url: http://127.0.0.1:8080
        trusted_root: aHR0cDovLzEyNy4wLjAuMTo4MDgwLzEucm9vdC5qc29u

DEFAULT_REPOSITORY: myrepo
```

--------------------------------

### Start Minikube Tunnel

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/quick-start

Starts a Minikube tunnel to expose services running in the Minikube cluster to the host machine. This process must remain active.

```shell
❯ minikube tunnel
✅  Tunnel successfully started

📌  NOTE: Please do not close this terminal as this process must stay alive for the tunnel to be accessible ...

❗  The service/ingress rstuf-localstack requires privileged ports to be exposed: [80 443]
🔑  sudo permission will be asked for it.
❗  The service/ingress rstuf-rstuf-api requires privileged ports to be exposed: [80 443]
🏃  Starting tunnel for service rstuf-localstack.
🔑  sudo permission will be asked for it.
🏃  Starting tunnel for service rstuf-rstuf-api.
Password:
```

--------------------------------

### Install repository-service-tuf

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Installs the Repository Service for TUF CLI using pip.

```shell
pip install repository-service-tuf
```

--------------------------------

### RSTUF CLI Ceremony and Bootstrap Guide

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/guide/kubernetes

The RSTUF CLI provides an interactive, guided process for performing the Ceremony and Bootstrap operations. This ensures proper setup of RSTUF settings and generation of initial TUF root metadata.

```rstuf-cli
rstuf ceremony
  # Interactively guides through setting up RSTUF configuration and generating initial TUF root metadata.
  # Generates a ceremony-payload.json file.

rstuf bootstrap --payload ceremony-payload.json
  # Uses the payload generated by the ceremony to activate the RSTUF service.
  # Can be performed separately after a disconnected ceremony.
```

--------------------------------

### Get RSTUF Helm Chart

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/guide/quick-start

This command is used to obtain the RSTUF Helm chart, which is necessary for deploying RSTUF using Helm. It specifies the version of the chart to be fetched.

```bash
0.2.0
1.0.0b1
for
0.2.0
1.0.0b1
0.2.0
1.0.0b1
for
```

--------------------------------

### Start Minikube with Ingress Addon

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/guide/quick-start

This command initiates Minikube, a tool for running a Kubernetes cluster locally, and enables the ingress addon. Ingress is crucial for managing external access to services within the Kubernetes cluster.

```shell
=docker
❯enable
enable
```

--------------------------------

### Example values.yaml for RSTUF Deployment

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/helm

An example configuration file (values.yaml) for deploying RSTUF API, RSTUF Worker, Valkey, and PostgreSQL using Helm.

```yaml
rstuf/rstuf-api:
  enabled: true
rstuf/rstuf-worker:
  enabled: true
valkey:
  enabled: true
postgresql:
  enabled: true

```

--------------------------------

### Start Minikube Tunnel

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/guide/quick-start

Initiates a Minikube tunnel to expose services running inside the Minikube cluster to the host machine. This command is used to make the services accessible via their configured local domains.

```shell
dofor[80443]
🔑for[80443]
🏃forforfor
```

--------------------------------

### RSTUF Admin Ceremony Help

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/setup

Displays the help message for the rstuf admin ceremony command, showing available options and usage.

```bash
❯ rstuf admin ceremony -h
```

--------------------------------

### Kubernetes Deployment Guides

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/index

Guides for deploying RSTUF on Kubernetes using Helm charts or YAML manifests.

```APIDOC
Kubernetes Deployment:
  Helm Chart: Guides for deploying RSTUF using the official Helm chart.
  YAML Manifest: Guides for deploying RSTUF using raw Kubernetes YAML manifests.
```

--------------------------------

### Python TUF Client Example for TOFU

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/general/client

Demonstrates Trust-on-first-use (TOFU) for bootstrapping an initial trust relationship with the metadata repository using the python-tuf library's client example application.

```Python
# Link to the python-tuf client example application demonstrating TOFU:
# https://github.com/theupdateframework/python-tuf/tree/develop/examples/client
```

--------------------------------

### Repository Service for TUF API Docker Environment Variables

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/index

Configuration options for the Repository Service for TUF API Docker image, focusing on environment variables for setup and operation.

```Docker
Environment Variables for RSTUF API Docker Image:

Required Variables:
  - RSTUF_BROKER_SERVER: The URL of the message broker server.
  - RSTUF_REDIS_SERVER: The connection string for the Redis server.

Optional Variables:
  - RSTUF_REDIS_SERVER_PORT: The port for the Redis server (defaults to 6379).
  - RSTUF_REDIS_SERVER_DB_RESULT: The Redis database number for storing results (defaults to 0).
  - RSTUF_REDIS_SERVER_DB_REPO_SETTINGS: The Redis database number for storing repository settings (defaults to 1).
  - RSTUF_DISABLED_ENDPOINTS: A comma-separated list of API endpoints to disable.
  - SECRETS_RSTUF_SSL_CERT: Path to the SSL certificate file for secure connections.
```

--------------------------------

### RSTUF Broker Server Configuration Examples

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/planning/deployment

Examples of how to configure the RSTUF_BROKER_SERVER for Redis and RabbitMQ, including specifying database IDs and vhosts.

```APIDOC
RSTUF_BROKER_SERVER:
  - Description: Specifies the message queue/broker server for RSTUF API and Worker.
  - Examples:
    - Redis (using database ID 5): `redis://redis/5`
    - RabbitMQ (using vhost 'rstuf_vhost'): `"amqp://guest:guest@rabbitmq:5672/rstuv_vhost"`
```

--------------------------------

### RSTUF CLI Configuration Example (YAML)

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/repository-service-tuf-cli/index

Example configuration for the RSTUF CLI, specifying repository details like artifact base URL, hash prefix, metadata URL, and trusted root.

```yaml
REPOSITORIES:
myrepo:
artifact_base_url:http://127.0.0.1:8081
hash_prefix:false
metadata_url:http://127.0.0.1:8080
trusted_root:aHR0cDovLzEyNy4wLjAuMTo4MDgwLzEucm9vdC5qc29u
```

--------------------------------

### Add RSTUF Helm Repository

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/quick-start

Adds the RSTUF Helm chart repository to your Helm configuration and updates the repository to fetch the latest chart information.

```shell
❯ helm repo add rstuf https://repository-service-tuf.github.io/helm-charts

❯ helm repo update

❯ helm search repo rstuf
NAME                    CHART VERSION   APP VERSION     DESCRIPTION
rstuf/rstuf-api         0.2.0           1.0.0b1         A RSTUF API Helm chart for Kubernetes
rstuf/rstuf-demo        0.2.0           1.0.0b1         RSTUF Demo deploying RSTUF services and infrast...
rstuf/rstuf-worker      0.2.0           1.0.0b1         A RSTUF Worker Helm chart for Kubernetes
```

--------------------------------

### Verify Docker Installation

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/contributing

Confirms that Docker, a platform for developing, shipping, and running applications in containers, is installed. This is crucial for setting up the development environment.

```bash
docker -v
```

--------------------------------

### Check RSTUF Pod Status

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/quick-start

Retrieves the status of all pods running within the 'rstuf' namespace to verify the deployment.

```shell
❯ kubectl get pod -n rstuf
NAME                                  READY   STATUS    RESTARTS      AGE
rstuf-localstack-5c9b844668-w9rqq     1/1     Running   0             2m10s
rstuf-postgresql-0                    1/1     Running   0             2m10s
rstuf-rstuf-api-69b689dff5-c5wh7      1/1     Running   1 (29s ago)   2m10s
rstuf-rstuf-worker-84957d95b7-msbzl   1/1     Running   1 (14s ago)   2m10s
rstuf-valkey-master-0                 1/1     Running   0             2m10s
```

--------------------------------

### RSTUF Redis Server Configuration Examples

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/planning/deployment

Configuration examples for RSTUF_REDIS_SERVER, RSTUF_REDIS_SERVER_DB_RESULT, and RSTUF_REDIS_SERVER_DB_REPO_SETTINGS to manage Redis as a result backend and for storing RSTUF settings.

```APIDOC
RSTUF_REDIS_SERVER:
  - Description: Specifies the Redis server for result backend and RSTUF settings.
  - Example: `redis://redis`

RSTUF_REDIS_SERVER_DB_RESULT:
  - Description: Optional. Specifies the Redis database ID for storing task results.
  - Example: `6`

RSTUF_REDIS_SERVER_DB_REPO_SETTINGS:
  - Description: Optional. Specifies the Redis database ID for storing RSTUF repository settings.
  - Example: `7`

Combined Configuration Example:
  RSTUF_BROKER_SERVER=redis://redis/5
  RSTUF_REDIS_SERVER=redis://redis
  RSTUF_REDIS_SERVER_DB_RESULT=6
  RSTUF_REDIS_SERVER_DB_REPO_SETTINGS=7
```

--------------------------------

### Verify Make Installation

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/contributing

Checks if the Make build automation tool is installed in the environment. Make is used for various development tasks like running, building, updating docs, and tests.

```bash
make --version
```

--------------------------------

### TUF Metadata Configuration

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/general/introduction

Mentions that TUF metadata configurations, such as key count, thresholds, and expiration, are customizable during the initial Service Setup.

```rst
Configurations are customizable during the initial
:ref:`guide/deployment/setup:Service Setup`, such as the number of keys,
thresholds, expiration, etc.
```

--------------------------------

### Kubernetes Deployment with Helm Chart

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/index

Instructions for deploying RSTUF using a Helm chart on Kubernetes. This includes prerequisites, usage of the Helm chart, and an example of the `values.yaml` file for customization.

```yaml
## Example of `values.yaml` for Helm Chart
# This file allows customization of the RSTUF deployment.
# Example configuration:
# replicaCount: 1
# image:
#   repository: "your-docker-repo/rstuf"
#   tag: "latest"
# service:
#   type: "ClusterIP"
#   port: 80
# ingress:
#   enabled: false
# persistence:
#   enabled: true
#   storageClassName: "standard"
#   accessModes: ["ReadWriteOnce"]
#   size: "10Gi"
# resources:
#   limits:
#     cpu: "500m"
#     memory: "512Mi"
#   requests:
#     cpu: "250m"
#     memory: "256Mi"

```

--------------------------------

### Docker Deployment Guide

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/index

Instructions for deploying RSTUF using Docker containers.

```APIDOC
Docker Deployment:
  Instructions for deploying RSTUF as Docker containers.
```

--------------------------------

### Root Keys and Threshold Example

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/general/keys

Illustrates the configuration of Root keys and their threshold for offline operations in RSTUF. This example shows how an organization defines the number of Root keys and the minimum number required for metadata updates.

```rstuf
Root keys: 5
Root keys threshold: 2
```

--------------------------------

### Check Pod Status

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/guide/quick-start

Verifies if all deployed pods are in a running state. This is a crucial step after deployment to ensure all components are functioning correctly.

```shell
1/101/101/11(29s)1/11(14s)1/10
```

--------------------------------

### RSTUF Deployment Planning and Configuration

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/index

Resources for planning and configuring RSTUF deployments, including service setup, volumes, services, and networking.

```APIDOC
Deployment Planning and Configuration:
  Service Setup: Details on setting up the RSTUF service.
  Volumes: Information on persistent storage volumes for RSTUF.
  Services: Configuration related to Kubernetes Services for RSTUF.
  Networking: Details on network configuration for RSTUF deployments.
  Deployment Configuration: Comprehensive guide to configuring RSTUF deployments.
```

--------------------------------

### Deploy RSTUF Demo using Helm

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/quick-start

Deploys the RSTUF demo application using the Helm chart, creating a new namespace named 'rstuf' if it doesn't exist.

```shell
❯ helm upgrade --install rstuf rstuf/rstuf-demo -n rstuf --create-namespace
Release "rstuf" does not exist. Installing it now.
NAME: rstuf
LAST DEPLOYED: Sat Sep 28 10:37:08 2024
NAMESPACE: rstuf
STATUS: deployed
REVISION: 1
```

--------------------------------

### Kubernetes Secrets Manifest (YAML)

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/kubernetes

An example Kubernetes YAML manifest for creating secrets, including `onlinekey` and `postgrespassword`.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: onlinekey
  type: Opaque
data:
  # base64 encoded key content
  key: YWI2ODU0YzE5MjlmNjYxNTc4MTBhNDBjMjQ1ZGU0NGJAQEBAMTAwMDAwQEBAQGUxZTk4MzMyZTZiYmNkM2M2ZjdmMGFiZjczNTdmNDNmZGJhN2QwMTRkYzYwMDk2YzNkODRkZjIyYTc3NDUwYmVAQEBANDgxNWEzNTgxZTB
---
apiVersion: v1
kind: Secret
metadata:
  name: postgrespassword
  type: Opaque
data:
  # base64 encoded postgres password
  password: UG9zdGdyZVNRTHN0cm9uZ1Bhc3N3b3Jk
```

--------------------------------

### Running Functional Tests

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/development

Instructions for running functional tests (FT) for each component of the Repository Service for TUF. This includes starting the development deployment and then initiating the functional tests using a make command. It also outlines available global environment variables for test configuration.

```bash
make run-dev
make ft-<type>
```

--------------------------------

### Kubernetes Services Manifest (YAML)

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/kubernetes

An example Kubernetes YAML manifest for defining services for Redis, PostgreSQL, web-metadata, and the RSTUF API.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: redis
spec:
  selector:
    app: redis
  ports:
    - protocol: TCP
      port: 6379
      targetPort: 6379
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
spec:
  selector:
    app: postgres
  ports:
    - protocol: TCP
      port: 5432
      targetPort: 5432
---
apiVersion: v1
kind: Service
metadata:
  name: web-metadata
spec:
  selector:
    app: webserver
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
  name: rstuf-api
spec:
  selector:
    app: rstuf-api
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: LoadBalancer
```

--------------------------------

### Applying Kubernetes Deployment

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/kubernetes

This snippet demonstrates the shell commands used to apply the Kubernetes deployment configuration and to get the status of the running pods.

```shell
❯ kubectl apply -f deployment.yml
deployment.apps/redis created
deployment.apps/postgres created
deployment.apps/web-metadata created
deployment.apps/rstuf-worker created
deployment.apps/rstuf-api created

❯ kubectl get pods
NAME                            READY   STATUS    RESTARTS   AGE
postgres-64866cf7f9-p4clt       1/1     Running   0          4m12s
redis-6f6fbbd9ff-ckrrt          1/1     Running   0          4m12s
rstuf-api-7cd78b65f7-sn56n      1/1     Running   0          4m12s
rstuf-worker-5b89554c95-xrlgb   1/1     Running   0          4m12s
web-metadata-75f59886f-h274h    1/1     Running   0          4m12s
```

--------------------------------

### Kubernetes Volumes Manifest (YAML)

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/kubernetes

An example Kubernetes YAML manifest for defining persistent volume claims for RSTUF storage, Redis data, and PostgreSQL data.

```yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: rstuf-storage
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: redis-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
```

--------------------------------

### Configure Local Domain for RSTUF and Localstack

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/deployment/guide/quick-start

Adds the RSTUF API and Localstack services to the Minikube environment's local domain configuration. This allows access to these services using custom domain names.

```bash
echo"$(minikube) rstuf.local localstack.local"|
```

--------------------------------

### Configure Local Hosts for RSTUF Services

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/quick-start

Adds entries to the /etc/hosts file to map .local domains to the Minikube IP address, enabling access to RSTUF API and Localstack services.

```shell
❯ echo "$(minikube ip) rstuf.local localstack.local" | sudo tee -a /etc/hosts
```

--------------------------------

### RSTUF CLI Artifact Repository Show Help

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Displays help information for the 'rstuf artifact repository show' command, used to list all configured repositories.

```bash
> rstuf artifact repository show --help

Usage: rstuf artifact repository show [OPTIONS] [REPOSITORY]

List configured repositories.
```

--------------------------------

### Verify Docker Compose Installation

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/contributing

Checks if Docker Compose, a tool for defining and running multi-container Docker applications, is installed. It's automatically installed with Docker for Mac and Windows.

```bash
docker compose version
```

--------------------------------

### Create Virtual Environment and Install Requirements

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/contributing

Creates a virtual environment for the RSTUF project using Pipenv and installs the project's dependencies from the Pipfile. The '-d' flag installs development requirements.

```bash
pipenv install

```

```bash
pipenv install -d
```

--------------------------------

### How to Get Involved

Source: https://repository-service-tuf.readthedocs.io/en/stable/blog/posts/rstuf-security-audit-for-1.0

Provides information on how to get involved with the RSTUF project.

```APIDOC
How to get involved
https://repository-service-tuf.readthedocs.io/en/stable/index.html#how-to-get-involved
```

--------------------------------

### TUF Metadata Overview

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/general/introduction

Provides an overview of TUF metadata usage in RSTUF, referencing PEP 458 for secure PyPI downloads and linking to TUF documentation for specific metadata roles.

```rst
Repository Service for TUF (RSTUF) secures downloads with signed repository
metadata using a design based on Python's `PEP 458 – Secure PyPI downloads
with signed repository metadata <https://peps.python.org/pep-0458/>`_.

.. image:: /_static/1_1_rstuf_metadata.png


More details about the above roles in the TUF documentation:

* `Root <https://theupdateframework.io/metadata/#root-metadata-rootjson>`_
* `Targets <https://theupdateframework.io/metadata/#targets-metadata-targetsjson>`_
* bins as `Delegated Targets <https://theupdateframework.io/metadata/#delegated-targets-metadata-role1json>`_,
  using `succinct delegation <https://github.com/theupdateframework/taps/blob/master/tap15.md#abstract>`_
* `Snapshot <https://theupdateframework.io/metadata/#snapshot-metadata-snapshotjson>`_
* `Timestamp <https://theupdateframework.io/metadata/#timestamp-metadata-timestampjson>`_
```

--------------------------------

### RSTUF CLI Help

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Displays the main help message for the RSTUF CLI, showing available options and commands.

```shell
❯ rstuf -h

Usage: rstuf [OPTIONS] COMMAND [ARGS]...

Repository Service for TUF Command Line Interface (CLI).

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ --config        -c  TEXT  Repository Service for TUF config file. [default: /Users/kairo/.rstuf.yml]                 │
│ --version                 Show the version and exit.                                                                 │
│ --autocomplete            Enable tab autocompletion and exit.                                                        │
│ --help          -h        Show this message and exit.                                                                │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ admin                             Administrative  Commands                                                           │
│ admin-legacy                      Administrative (Legacy) Commands                                                   │
│ artifact                          Artifact Management Commands                                                       │
│ key                               Cryptographic Key Commands                                                         │
│ task                              Task Management Commands                                                           │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
```

--------------------------------

### RSTUF CLI Artifact Download Help

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Displays help information for the 'rstuf artifact download' command, outlining its usage and available options for downloading artifacts using TUF metadata.

```bash
> rstuf artifact download --help

Usage: rstuf artifact download [OPTIONS] ARTIFACT_NAME

Downloads an artifact using TUF metadata from a given artifacts URL.
Note: all options for this command can be configured.
Read 'rstuf artifact repository' documentation for more information.

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮n│ --root              -r  TEXT  A metadata URL to the initial trusted root or a local file.        │
│ --metadata-url      -m  TEXT  TUF Metadata repository URL.                                       │
│ --artifacts-url     -a  TEXT  An artifacts base URL to fetch from.                               │
│ --hash-prefix       -p        A flag to prefix an artifact with a hash.                          │
│ --directory-prefix  -P  TEXT  A prefix for the download dir.                                     │
│ --help              -h        Show this message and exit.                                        │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
```

--------------------------------

### RSTUF Components Overview

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/general/introduction

Lists the main components of the Repository Service for TUF (RSTUF), including the API, Worker, and CLI, and their primary functions.

```rst
.. image:: /_static/1_1_rstuf.png

Repository Service for TUF (RSTUF) is a combination of micro-services provided
as containers:

 * Repository Service for TUF API (RSTUF API ``repository-service-tuf-api``)
 * Repository Service for TUF Worker (RSTUF Worker ``repository-service-tuf-worker``)

Repository Service for TUF (RSTUF) also provides a Command Line Interface tool
to manage RSTUF deployments.

 * Repository Service for TUF CLI (RSTUF CLI ``repository-service-tuf-cli``)
```

--------------------------------

### Install Pipenv

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/contributing

Installs Pipenv, a dependency management tool that automatically creates and manages virtual environments for Python projects. It's used by RSTUF to manage project dependencies.

```bash
pip install --user pipenv
```

--------------------------------

### RSTUF CLI Artifact Repository Add Help

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Displays help information for the 'rstuf artifact repository add' command, detailing the options required to add a new repository configuration.

```bash
> rstuf artifact repository add --help

Usage: rstuf artifact repository add [OPTIONS]

Add a new repository.

╭─ Options ──────────────────────────────────────────────────────────────────────────────────────────────────╮
│ *  --name           -n  TEXT  The repository name. [required]                                              │
│ *  --root           -r  TEXT  The metadata URL to the initial trusted root or a local file. [required]     │
│ *  --metadata-url   -m  TEXT  TUF Metadata repository URL. [required]                                      │
│ *  --artifacts-url  -a  TEXT  The artifacts base URL to fetch from. [required]                             │
│    --hash-prefix    -p        Whether to add a hash prefix to artifact names.                              │
│    --help           -h        Show this message and exit.                                                  │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
```

--------------------------------

### RSTUF Components Overview

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/general/introduction

Provides an overview of the core components of the Repository Service for TUF (RSTUF), including the API, Worker, and CLI, and their primary functions.

```APIDOC
RSTUF Components:
  - Repository Service for TUF API (RSTUF API `repository-service-tuf-api`): Delivers an HTTP REST API for integration and service management, integrating with CI/CD or artifact release management flows.
  - Repository Service for TUF Worker (RSTUF Worker `repository-service-tuf-worker`): An isolated workload service that manages TUF metadata, including updating, signing, and publishing.
  - Repository Service for TUF CLI (RSTUF CLI `repository-service-tuf-cli`): A CLI application to manage the Repository Service for TUF deployments.
```

--------------------------------

### RSTUF CLI Artifact Repository Set Help

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Displays help information for the 'rstuf artifact repository set' command, used to switch the currently active repository configuration.

```bash
> rstuf artifact repository set --help

Usage: rstuf artifact repository set [OPTIONS] REPOSITORY

Switch current repository.
```

--------------------------------

### Python Example - Adding Artifacts

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/general/usage

A Python example demonstrating how to interact with the RSTUF API to add an artifact to the TUF metadata. This involves making an HTTP POST request to the appropriate endpoint with the necessary artifact information.

```Python
import requests

def add_artifact_to_tuf(base_url, artifact_path, artifact_hash, version):
    """Adds an artifact to TUF metadata using the RSTUF API."""
    endpoint = f"{base_url}/add_artifact"
    payload = {
        "artifact_path": artifact_path,
        "artifact_hash": artifact_hash,
        "version": version
    }
    try:
        response = requests.post(endpoint, json=payload)
        response.raise_for_status()  # Raise an exception for bad status codes
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"Error adding artifact: {e}")
        return None

# Example usage:
# rstuf_base_url = "http://localhost:8080/api/v1"
# artifact_path = "/path/to/my/artifact.txt"
# artifact_hash = "sha256:abcdef123456..."
# artifact_version = "1.0"
# result = add_artifact_to_tuf(rstuf_base_url, artifact_path, artifact_hash, artifact_version)
# print(result)
```

--------------------------------

### Python Example - Removing Artifacts

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/general/usage

A Python example demonstrating how to interact with the RSTUF API to remove an artifact from the TUF metadata. This involves making an HTTP POST request to the remove artifact endpoint with the artifact's path.

```Python
import requests

def remove_artifact_from_tuf(base_url, artifact_path):
    """Removes an artifact from TUF metadata using the RSTUF API."""
    endpoint = f"{base_url}/remove_artifact"
    payload = {
        "artifact_path": artifact_path
    }
    try:
        response = requests.post(endpoint, json=payload)
        response.raise_for_status()  # Raise an exception for bad status codes
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"Error removing artifact: {e}")
        return None

# Example usage:
# rstuf_base_url = "http://localhost:8080/api/v1"
# artifact_path_to_remove = "/path/to/my/artifact.txt"
# result = remove_artifact_from_tuf(rstuf_base_url, artifact_path_to_remove)
# print(result)
```

--------------------------------

### Apply Kubernetes Secrets (Shell)

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/kubernetes

Command to apply the Kubernetes secrets manifest and verify their creation.

```shell
❯ kubectl apply -f secrets.yml
secret/onlinekey created
secret/postgrespassword created

❯ kubectl get secrets
NAME                  TYPE                                  DATA   AGE
default-token-dqt9k   kubernetes.io/service-account-token   3      22d
onlinekey             Opaque                                1      2s
postgrespassword      Opaque                                1      2s
```

--------------------------------

### Apply Kubernetes Services (Shell)

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/kubernetes

Command to apply the Kubernetes services manifest and verify the creation of services.

```shell
❯ kubectl apply -f services.yml
service/redis created
service/postgres created
service/web-metadata created
service/rstuf-api created

❯ kubectl get services
NAME           TYPE           CLUSTER-IP       EXTERNAL-IP       PORT(S)        AGE
```

--------------------------------

### Repository Service for TUF Release Steps

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/release

Outlines the steps involved in releasing a new version of the Repository Service for TUF, from tag creation to general availability.

```APIDOC
Release Process:
  1. Create a tag `vX.Y.Z`.
  2. The tag triggers `.github/workflow/cd.yml` to generate a release candidate artifact (e.g., `v0.1.3-rc`).
  3. After tests and validation, a maintainer approves the artifact for General Availability (GA).
```

--------------------------------

### Repository Service for TUF API Documentation

Source: https://repository-service-tuf.readthedocs.io/en/stable/guide/index

Documentation for the Repository Service for TUF API, outlining available endpoints and their functionalities.

```APIDOC
Repository Service for TUF API:
  This section details the API endpoints for interacting with the Repository Service for TUF.

  Endpoints:
    - /guide/repository-service-tuf-api/index.html: General API documentation.

  Functionalities:
    - Managing TUF metadata and artifacts.
    - Interacting with the TUF client.
```

--------------------------------

### RSTUF CLI Artifact Repository Help

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/repository-service-tuf-cli/index

Displays help information for the 'rstuf artifact repository' command, which manages RSTUF repository configurations. It lists available subcommands for repository management.

```bash
> rstuf artifact repository --help

Usage: rstuf artifact repository [OPTIONS] COMMAND [ARGS]...

Repository management.

╭─ Options ────────────────────────────────────────────────────────────────╮
│ --help  -h    Show this message and exit.                                │
╰──────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────╮
│ add                              Add a new repository.                   │
│ delete                           Delete a repository.                    │
│ set                              Switch current repository.              │
│ show                             List configured repositories.           │
│ update                           Update repository.                      │
╰──────────────────────────────────────────────────────────────────────────╯
```

--------------------------------

### Apply Kubernetes Volumes (Shell)

Source: https://repository-service-tuf.readthedocs.io/en/stable/_sources/guide/deployment/guide/kubernetes

Command to apply the Kubernetes volumes manifest and verify the creation of persistent volume claims.

```shell
❯ kubectl apply -f volumes.yml
persistentvolumeclaim/rstuf-storage created
persistentvolumeclaim/redis-data created
persistentvolumeclaim/postgres-data created

❯ kubectl get pv
NAME                   CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                     REASON   AGE
pvc-5184d98009604a73   10Gi       RWO            Retain           Bound    default/redis-data                  7s
pvc-79aff76456bd433f   10Gi       RWO            Retain           Bound    default/rstuf-storage               9s
pvc-c3ee2645d4114816   10Gi       RWO            Retain           Bound    default/postgres-data               8s
```

--------------------------------

### Repository Service for TUF Experimental Version Features

Source: https://repository-service-tuf.readthedocs.io/en/stable/devel/roadmap

Details the features completed for the experimental version of the Repository Service for TUF. This includes initial TUF metadata bootstrapping, local file system storage and key vault services, target management, token generation, settings retrieval, and automatic version bumping for various metadata types.

```APIDOC
Repository Service for TUF - Experimental Version Features:

Status: Done

Features:
  - Bootstrap the Repository Service for TUF (Initial TUF Metadata)
  - Storage Service: Local file system
  - Key Vault Service: Local file system
  - Add targets
  - Delete targets
  - Generate Token
  - Retrieves the Repository Service for TUF settings
  - Automatically version Bump Snapshot Metadata
  - Automatically version Bump Timestamp Metadata
  - Automatically version Bump hash-bins Metadata
  - Release CI/CD in all components
```
Tokens:
Raw