theupdateframework / theupdateframework/specification

Does each of the root metadata roles require at least one keyid, and a threshold >= 1?

Open
#251 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
405
Forks
59
Avg merge
3d 4h
Merged PRs (30d)
1

Description

In the root.json part of the spec, it states that it is required to have a role defined for root, targets, snapshot, timestamp, and optionally mirror. However in the section for keyid, it does not explicitly state that each role needs to have at least one keyid. Should it? Presumably we should, otherwise we would allow for unsigned metadata.

Likewise, should we also require that threshold must be greater than or equal to one?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read the linked root.json, keyid, and threshold sections of the specification first. Determine whether root, targets, snapshot, timestamp, and optional mirror roles must each have at least one keyid and whether threshold must be at least 1. Done means the specification explicitly resolves both validation requirements.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.