OpenSSF project
gittuf
A platform-agnostic security layer for Git that applies The Update Framework concepts to source control — enforcing who may change what through signed policy and a tamper-evident reference state log.
How each persona uses gittuf
Software Developer / Maintainer Developer
Protects their repository with signed, platform-independent rules governing who can change which branches and tags.
Security Engineer / Architect Security
Enforces access and authorization policy on Git itself, backed by a tamper-evident log that survives a forge compromise.
CI/CD DevOps & Tooling Integrator DevOps
Verifies a repository's reference state log in the pipeline so builds only proceed from history that satisfies the signed policy.
Open Source Professional (OSPO) OSPO
Applies consistent, forge-independent repository security policy across projects regardless of which Git host each one uses.
Problems gittuf helps with
Secure Repository Configuration Configuration
Enforces signed repository policy — who may change what — independently of the hosting platform's own settings.
Artefact Signing & Verification Signing
Signs Git metadata and maintains a verifiable reference state log so source history can be authenticated downstream.