theupdateframework / theupdateframework/specification
Does each of the root metadata roles require at least one keyid, and a threshold >= 1?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 405
- Forks
- 59
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 1
Description
In the root.json part of the spec, it states that it is required to have a role defined for root, targets, snapshot, timestamp, and optionally mirror. However in the section for keyid, it does not explicitly state that each role needs to have at least one keyid. Should it? Presumably we should, otherwise we would allow for unsigned metadata.
Likewise, should we also require that threshold must be greater than or equal to one?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the linked root.json, keyid, and threshold sections of the specification first. Determine whether root, targets, snapshot, timestamp, and optional mirror roles must each have at least one keyid and whether threshold must be at least 1. Done means the specification explicitly resolves both validation requirements.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100