# @tufjs/cli

> CLI for interacting with TUF repositories

Latest version **0.6.0** (published 2026-06-01) · MIT license · 0 weekly downloads

## Install

```sh
npm install @tufjs/cli
pnpm add @tufjs/cli
yarn add @tufjs/cli
bun add @tufjs/cli
```

Provides the command `tuf`.

## Health

**Score 60/100 (C)** — status: active.

Positive: has types; no vulnerabilities; has provenance; high maintenance score.

Warnings: low downloads; no esm support; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.6.0 |
| Published | 2026-06-01 |
| First published | 2023-10-06 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | ^22.22.2 \|\| ^24.15.0 \|\| >=26.0.0 |
| Dependencies | 4 |
| Unpacked size | 12.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 83 |
| Author | bdehamer@github.com |
| Maintainers | eugenethehub, bdehamer |
| Keywords | tuf, security, cli |

## Links

- npm: https://www.npmjs.com/package/@tufjs/cli
- Repository: https://github.com/theupdateframework/tuf-js
- Homepage: https://github.com/theupdateframework/tuf-js/tree/main/packages/cli#readme
- Issues: https://github.com/theupdateframework/tuf-js/issues
- npm.io page: https://npm.io/package/@tufjs/cli

## Dependencies (4)

- [tuf-js](https://npm.io/package/tuf-js.md) 6.0.0
- [@oclif/core](https://npm.io/package/@oclif/core.md) ^4
- [@oclif/color](https://npm.io/package/@oclif/color.md) ^1.0.13
- [@oclif/plugin-help](https://npm.io/package/@oclif/plugin-help.md) ^6

## Alternatives

- [@salesforce/cli](https://npm.io/package/@salesforce/cli.md) — 389.7K weekly downloads
- [@mintlify/cli](https://npm.io/package/@mintlify/cli.md) — 208.9K weekly downloads
- [@grafana/e2e-selectors](https://npm.io/package/@grafana/e2e-selectors.md) — 128.7K weekly downloads
- [mintlify](https://npm.io/package/mintlify.md) — 112.0K weekly downloads
- [@intlayer/cli](https://npm.io/package/@intlayer/cli.md) — 22.8K weekly downloads

## Recent versions

- 0.6.0 (latest) — 2026-06-01
- 0.5.1 — 2026-04-09
- 0.4.1 — 2025-12-18
- 0.4.0 — 2025-07-25
- 0.3.1 — 2025-07-02
- 0.3.0 — 2025-01-15
- 0.2.5 — 2024-10-14
- 0.2.4 — 2024-10-09
- 0.2.3 — 2024-06-19
- 0.2.2 — 2024-05-06
- 0.2.1 — 2024-01-10
- 0.2.0 — 2023-10-18
- 0.1.1 — 2023-10-12
- 0.1.0 — 2023-10-06

## README

# @tufjs/cli

CLI for securely downloading targets from TUF repositories.

# Usage
<!-- usage -->
```sh-session
$ npm install -g @tufjs/cli
$ tuf COMMAND
running command...
$ tuf (--version)
@tufjs/cli/0.6.0 linux-x64 node-v24.16.0
$ tuf --help [COMMAND]
USAGE
  $ tuf COMMAND
...
```
<!-- usagestop -->
# Commands
<!-- commands -->
* [`tuf download-target`](#tuf-download-target)
* [`tuf help [COMMAND]`](#tuf-help-command)

## `tuf download-target`

download a target from a TUF repository and verify its signature

```
USAGE
  $ tuf download-target --metadata-base-url <value> --target-name <value> [--cache-path <value>] [--target-base-url
    <value>] [--root <value>] [--unsafe-root-download] [-o <value>]

FLAGS
  -o, --output-file=<value>        write output to file
      --cache-path=<value>         path to the Sigstore TUF cache
      --metadata-base-url=<value>  (required) URL to the TUF metadata repository
      --root=<value>               path to the initial trusted root
      --target-base-url=<value>    URL to the TUF target repository
      --target-name=<value>        (required) name of the target to download
      --unsafe-root-download       allow downloading the trusted root from the TUF metadata repository (THIS IS NOT
                                   SAFE)

DESCRIPTION
  download a target from a TUF repository and verify its signature

ALIASES
  $ tuf download

EXAMPLES
  $ tuf download-target
```



## `tuf help [COMMAND]`

Display help for tuf.

```
USAGE
  $ tuf help [COMMAND...] [-n]

ARGUMENTS
  [COMMAND...]  Command to show help for.

FLAGS
  -n, --nested-commands  Include all nested commands in the output.

DESCRIPTION
  Display help for tuf.
```


<!-- commandsstop -->

---
_Source: https://npm.io/package/@tufjs/cli · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._