Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Specify in which order metadata should be published to the repository #126

Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 21 additions & 6 deletions tuf-spec.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# <p align="center">The Update Framework Specification

Last modified: **30 September 2020**
Last modified: **06 October 2020**

Version: **1.0.9**
Version: **1.0.10**

We strive to make the specification easy to implement, so if you come across
any inconsistencies or experience any difficulty, do let us know by sending an
Expand All @@ -17,7 +17,7 @@ repo](https://github.com/theupdateframework/specification/issues).
- [2. System Overview](#2-system-overview)
- [3. The Repository](#3-the-repository)
- [4. Document Formats](#4-document-formats)
- [5. Detailed Workflows](#5-detailed-workflows)
- [5. Detailed Client Workflow](#5-detailed-client-workflow)
- [6. Usage](#6-usage)
- [7. Consistent Snapshots](#7-consistent-snapshots)
- [F. Future Directions and Open Questions](#f-future-directions-and-open-questions)
Expand Down Expand Up @@ -462,6 +462,23 @@ repo](https://github.com/theupdateframework/specification/issues).
Delegated target roles are authorized by the keys listed in the directly
delegating target role.

* **3.2 Repository metadata creation**

Metadata SHOULD be generated in the following sequence, in order to ensure
that metadata are not referenced in the repository before they have been
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
that metadata are not referenced in the repository before they have been
that metadata files are not referenced in the repository before they have been

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had originally written that as files but then, with #103 in mind, removed it. Happy to add files back in if you think it is an improvement. I'm anticipating that #103 may require a more intentional set of edits to the specification.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Omitting the word file does makes more sense in the context of #103. I find the plural use of metadata a bit confusing, but I think it's technically correct.

created. The below sequence assumes that all targets files referenced by
the metadata are available to the repository before the metadata is written.
When mirrors metadata is published by a repository it MAY be written at
any point after the initial metadata for the mirrored repository has been
created.

* **3.2.1** delegated targets metadata (DELEGATED_ROLE.EXT)
* **3.2.2** root metadata (root.EXT)
* **3.2.3** top-level targets metadata (targets.EXT)
* **3.2.4** snapshot metadata (snapshot.EXT)
* **3.2.5** timestamp metadata (timestamp.EXT)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When would the mirror metadata be written?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh yes, I forgot about mirror. I think it could be written at any point after the root metadata, because it's not actually referenced by or referencing any metadata explicitly.

It may make sense to list it as 3.2.6, because then we can have some confidence that an implementation conforming to the spec won't write any mirrors metadata until all of the metadata it is mirroring has been written?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Listing it as 3.2.6 makes sense to me. We can also mention it in the paragraph above to state that it can be written at any point.

* **3.2.6** mirrors metadata (mirrors.EXT)

## **4. Document formats**

All of the formats described below include the ability to add more
Expand Down Expand Up @@ -1064,9 +1081,7 @@ repo](https://github.com/theupdateframework/specification/issues).
This behavior can be modified by the client code that uses the framework to,
for example, randomly select from the listed mirrors.

## **5. Detailed Workflows**

### **The client application**
## **5. Detailed Client Workflow**
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This contradicts the capitalisation change in #127


Note: If a step in the following workflow does not succeed (e.g., the update
is aborted because a new metadata file was not signed), the client should
Expand Down