Secure publication of Datadog Agent integrations with TUF and in-toto | Datadog (opens in new tab)

Datadog describes how it secures the publication and distribution of Datadog Agent integrations using The Update Framework (TUF) and in-toto. TUF protects clients from tampered, outdated, or incorrectly signed packages, while in-toto provides verifiable evidence about how each integration was built. Together, the systems create a chain of trust from source and build processes to the integration installed by an Agent.

Why Agent integrations need stronger supply-chain security

• Integrations are distributed software components that run inside the Datadog Agent.
• A compromise of the source repository, build infrastructure, signing credentials, or distribution system could lead to malicious code reaching customers.
• Authenticating only the final package is insufficient if attackers can:
  • Replace repository metadata
  • Replay an older vulnerable release
  • Roll back clients to compromised versions
  • Exploit a stolen signing key
  • Publish artifacts that were not produced by the approved build process

TUF for secure package distribution

• TUF separates repository responsibilities across cryptographic roles rather than relying on one signing key.
• Metadata roles such as root, targets, snapshot, and timestamp help clients verify:
  • Which keys are trusted
  • Which integrations and versions are authorized
  • Whether metadata is current
  • Whether files have been modified
• TUF protects against common repository attacks, including:
  • Key compromise through key rotation and delegation
  • Rollback attacks using version information
  • Freeze attacks using metadata expiration
  • Mix-and-match attacks involving inconsistent metadata
• The Datadog Agent can therefore reject integrations that fail authenticity, integrity, freshness, or version checks.

in-toto for build provenance

• in-toto complements TUF by describing and verifying the steps used to produce an integration.
• Build metadata can show that required steps—such as source retrieval, dependency installation, testing, packaging, and signing—were performed by authorized parties.
• Attestations connect each build step to its inputs and outputs, making unauthorized substitutions easier to detect.
• This ensures that a validly signed package was not merely signed, but was produced through the expected supply-chain process.

Combining distribution security and provenance

• TUF answers whether an integration is authorized and safe to download.
• in-toto answers whether it was built according to the approved process.
• The combined design creates layered verification:
  • TUF validates repository metadata and package integrity.
  • in-toto validates build identity, steps, and provenance.
  • The Agent enforces the resulting trust decisions before installation or update.
• This approach limits the impact of a compromise in any single part of the publication pipeline.

Datadog’s approach illustrates that software supply-chain security requires more than package signatures. Using TUF for resilient distribution metadata and in-toto for build provenance provides a stronger, defense-in-depth model for safely delivering Agent integrations.