Is it security to not update root.json first
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 466
- Forks
- 338
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 8
Description
General Question
TiUP may not follow TUF when update root.json
In manifest doc https://github.com/pingcap/tiup/blob/master/doc/design/manifest.md#deviations-from-tuf , it is not mentioned that tiup is difference whit TUF when start a update. But in https://github.com/pingcap/tiup/blob/master/doc/design/manifest.md#download-a-component-version-for-a-target ，it say we update timestamp.json first which not follow TUF.
Before #1554 ，tiup implement as TUF. After #1554 ，tiup implements as tiup doc
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with doc/design/manifest.md, especially “Deviations from TUF” and “Download a component version for a target,” then review the behavior change described around #1554. Determine whether the documented update order differs from TUF and document the conclusion and any needed clarification in the manifest documentation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100