# @sigstore/tuf > Client for the Sigstore TUF repository Latest version **5.0.0** (published 2026-06-01) · Apache-2.0 license · 0 weekly downloads ## Install ```sh npm install @sigstore/tuf pnpm add @sigstore/tuf yarn add @sigstore/tuf bun add @sigstore/tuf ``` ## Health **Score 65/100 (B)** — status: active. Positive: has types; no vulnerabilities; has provenance; high maintenance score; high quality score. Warnings: low downloads; no esm support. ## Facts | | | |---|---| | Version | 5.0.0 | | Published | 2026-06-01 | | First published | 2023-06-06 | | Weekly downloads | 0 | | License | Apache-2.0 | | TypeScript types | bundled | | Module format | CommonJS | | Node | ^22.22.2 \|\| ^24.15.0 \|\| >=26.0.0 | | Dependencies | 2 | | Unpacked size | 47.9 KB | | Known vulnerabilities | 0 | | Install scripts | no | | Provenance | attested (GitHub Actions) | | GitHub stars | 182 | | Author | bdehamer@github.com | | Maintainers | bdehamer | ## Links - npm: https://www.npmjs.com/package/@sigstore/tuf - Repository: https://github.com/sigstore/sigstore-js - Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/tuf#readme - Issues: https://github.com/sigstore/sigstore-js/issues - npm.io page: https://npm.io/package/@sigstore/tuf ## Dependencies (2) - [tuf-js](https://npm.io/package/tuf-js.md) ^6.0.0 - [@sigstore/protobuf-specs](https://npm.io/package/@sigstore/protobuf-specs.md) ^0.5.0 ## Recent versions - 5.0.0 (latest) — 2026-06-01 - 4.0.2 — 2026-03-18 - 4.0.1 — 2025-12-19 - 4.0.0 — 2025-07-29 - 3.1.1 — 2025-04-25 - 3.1.0 — 2025-02-04 - 3.0.0 — 2024-10-14 - 2.3.4 — 2024-05-16 - 2.3.3 — 2024-05-08 - 2.3.2 — 2024-03-25 - 2.3.1 — 2024-02-15 - 2.3.0 — 2024-01-12 - 2.2.0 — 2023-09-08 - 2.1.0 — 2023-08-29 - 2.0.0 — 2023-08-18 - … 4 more at https://npm.io/package/@sigstore/tuf/versions ## README # @sigstore/tuf · [![npm version](https://img.shields.io/npm/v/@sigstore/tuf.svg?style=flat)](https://www.npmjs.com/package/@sigstore/tuf) [![CI Status](https://github.com/sigstore/sigstore-js/workflows/CI/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/ci.yml) [![Smoke Test Status](https://github.com/sigstore/sigstore-js/workflows/smoke-test/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/smoke-test.yml) A JavaScript library for securely retrieving targets from the Sigstore [TUF][1] repository. ## Features - Embeds the trutsted root metadata file necessary to bootstrap interaction with the Sigstore TUF repository. - Automatically initializes the local TUF cache for storing metadata and target files. ## Prerequisites - Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0 ## Installation ``` npm install @sigstore/tuf ``` ## Usage ```javascript const { initTUF } = require('@sigstore/tuf'); ``` ```javascript import { initTUF } from '@sigstore/tuf'; ``` ### initTUF([options]) Returns a TUF client which can be used to retrieve any target from the Sigstore TUF repository. The local TUF cache will be initialized and the TUF metadata files downloaded from the [remote repository][2] as part of the initialization process. - `options` `` - `mirrorURL` ``: Base URL for the Sigstore TUF repository. Defaults to `'https://tuf-repo-cdn.sigstore.dev'` - `cachePath` ``: Absolute path to the directory to be used for caching downloaded TUF metadata and targets. Defaults to a directory named "sigstore-js" within the platform-specific application data directory. - `rootPath` ``: Path to the initial trust root for the TUF repository. Defaults to the [embedded root](./store/public-good-instance-root.json). - `forceInit` `boolean`: Force re-initialization of the TUF cache even if it already exists. Defaults to `false`. - `forceCache` `boolean`: Prevents any downloads from the remote TUF repository as long as all cached metadata files are un-expired. Defaults to `false`. - `force` `boolean`: Same as `forceInit` (deprecated). The `TUF` client object returned from `initTUF` has a single `getTarget` function which takes the name of a target in the Sigstore TUF repository and returns the content of that target. ### getTrustedRoot([options]) Retrieves the most recent version of the "trusted_root.json" target from the Sigstore TUF repository. The format of "trusted_root.json" file is described by the [TrustedRoot][3] protobuf and contains the complete set of trusted verification materials for the Sigstore public-good instance. - `options` `` - `mirrorURL` ``: Base URL for the Sigstore TUF repository. Defaults to `'https://tuf-repo-cdn.sigstore.dev'` - `cachePath` ``: Absolute path to the directory to be used for caching downloaded TUF metadata and targets. Defaults to a directory named "sigstore-js" within the platform-specific application data directory. - `rootPath` ``: Path to the initial trust root for the TUF repository. Defaults to the [embedded root](./store/public-good-instance-root.json). - `forceInit` `boolean`: Force re-initialization of the TUF cache even if it already exists. Defaults to `false`. - `forceCache` `boolean`: Prevents any downloads from the remote TUF repository as long as all cached metadata files are un-expired. Defaults to `false`. - `force` `boolean`: Same as `forceInit` (deprecated). [1]: https://theupdateframework.io/ [2]: https://sigstore-tuf-root.storage.googleapis.com/ [3]: https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_trustroot.proto --- _Source: https://npm.io/package/@sigstore/tuf · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._