trdl is a secure software delivery system that provides a trusted channel for distributing updates from Git repositories to end users using The Update Framework (TUF).
The tool addresses the challenge of securely delivering software updates by establishing a cryptographically verified pipeline. Git serves as the single source of truth for releases, while Vault manages GPG signature verification and maintains the TUF repository. Users select a release channel and continuously receive the latest software versions from the TUF repository, with the system ensuring both release security through multi-signature verification and storage security via signed objects and rotating TUF keys.
Organizations should adopt trdl when they need to distribute software updates across multiple environments with strong security guarantees and want to leverage existing Git workflows. The tool suits projects that require continuous delivery with cryptographic verification, particularly those already using Vault for secrets management. The project demonstrates production viability through its use in delivering the werf CI/CD tool to CI runners and user hosts.
The project maintains active engagement with users through GitHub Discussions for questions and careful issue processing. Development activity shows ongoing refinement of the core delivery pipeline, with documentation and developer resources being actively developed on the project website.
