theupdateframework / theupdateframework/specification

Do we always need to download snapshot and targets?

Open
#227 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
405
Forks
59
Avg merge
3d 4h
Merged PRs (30d)
1

Description

I'm updating rust-tuf to work with TUF-1.0.30. As part of reading through the spec, I that @rdimitrov changed the spec in #209 to allow us to exit the update-cycle early in update-timestamp 5.4.3.1. Should we apply this same logic to snapshots and targets?

rust-tuf currently implements this, where it will exit early if:

  • When updating the snapshot metadata, check if the trusted timestamp role's snapshot version matches the trusted snapshot version, and has the correct hash value, if present.
  • When updating the targets metadata, check if the trusted snapshot role's targets version matches the trusted targets version, and has the correct hash value, if present.
  • When updating a delegated targets metadata, check if the delegating targets role's version matches the trusted delegated targets version, and has the correct hash value, if present.

Is this optimization allowed? If so, should we describe it in the spec? If not, why is this dangerous?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked TUF specification section update-timestamp 5.4.3.1 and issue #209, then compare the snapshot, targets, and delegated-targets checks described here. Done means determining whether these early exits are permitted and whether the specification should document them, including any safety rationale.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
documentation, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.