theupdateframework / theupdateframework/specification
Clarify client workflow when no new metadata is available
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 405
- Forks
- 59
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 1
Description
The client workflow describes in detail how to update metadata in order to download a target. However, it should be clarified how use local trusted metadata in order to download a target even if no new metadata is available from remote.
Details per role
-
For root there actually are instructions to just proceed with target downloading if no new root version is available from remote, according to the version in the unsigned filename, and to the version in the signed metadata. The latter means that filename and signed version are inconsistent, which seems like a repo error. Should that really be ignored? (cc @rdimitrov, #209)
-
For timestamp instructions were also added in #209. However, the new wording -- "In case they are equal, discard the new timestamp metadata and abort the update cycle. This is normal and it shouldn't raise any error." -- seems contradictory. Should this rather be -- "In case they are equal, discard the new timestamp metadata and go to 5.5"? (re-cc @rdimitrov)
-
For snapshot and targets the instructions are to always download the version listed in timestamp (for snapshot) or snapshot (for targets) respectively. Would it be a fair optimization to only download, if the listed versions for either of them isn't already available locally?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the client workflow in tuf-spec.md, especially the root and timestamp passages linked in the issue and the snapshot and targets instructions. Compare the local-metadata cases across all four roles and resolve the inconsistencies and optimization question raised here and in #209. Done means the specification clearly states when to reuse, discard, or download metadata and what happens next.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100