Security & trust
TUF threat model
Meshanics treats artifact storage, registries, gateways, mirrors and delivery networks as untrusted. A device accepts an update only when metadata traces to its pinned tenant root and every signed constraint succeeds.
Expected attacks
| Attack | Client control |
|---|---|
| Target bytes changed in transit or storage | Signed target digest and length |
| Old target or metadata replayed | Monotonic metadata versions and rollback checks |
| Repository view held indefinitely | Timestamp and snapshot expiry checks |
| Online publishing key stolen | Role scope, expiry and separately authorized root rotation |
| Target path used across tenants | Certificate-derived tenant authorization plus signed logical path |
| Gateway modifies an air-gap release | Device retains end-to-end TUF and control-plane verification |
Limits
Managed roots use non-exportable Cloud KMS keys with software protection. Customer-controlled custody can remain offline. Meshanics does not claim hardware-backed or post-quantum signing. An attacker controlling an authorized publisher can still publish harmful but correctly signed bytes within that role's scope. Admission policy, approval, health probes and staged rollout reduce that separate risk.
See Summary of crypto keys and Verify our claims for the concrete key and inspection surfaces.