OpenSSF project

gittuf

A platform-agnostic security layer for Git that applies The Update Framework concepts to source control — enforcing who may change what through signed policy and a tamper-evident reference state log.

How each persona uses gittuf

Software Developer / Maintainer Developer

Protects their repository with signed, platform-independent rules governing who can change which branches and tags.

See everything for Developer →

Security Engineer / Architect Security

Enforces access and authorization policy on Git itself, backed by a tamper-evident log that survives a forge compromise.

See everything for Security →

CI/CD DevOps & Tooling Integrator DevOps

Verifies a repository's reference state log in the pipeline so builds only proceed from history that satisfies the signed policy.

See everything for DevOps →

Open Source Professional (OSPO) OSPO

Applies consistent, forge-independent repository security policy across projects regardless of which Git host each one uses.

See everything for OSPO →

Problems gittuf helps with

Secure Repository Configuration Configuration

Enforces signed repository policy — who may change what — independently of the hosting platform's own settings.

See everything for Configuration →

Artefact Signing & Verification Signing

Signs Git metadata and maintains a verifiable reference state log so source history can be authenticated downstream.

See everything for Signing →