theupdateframework / theupdateframework/specification
Document delegation removal in repository operations
@shubhusion is already working on this.
Since Jun 8, 2024.
- Dominant language
- Python
- Stars
- 405
- Forks
- 59
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 1
Description
@trishankatdatadog summarised the steps for removing a delegation in https://github.com/sigstore/root-signing/pull/546#issuecomment-1319169899. We really should include that in the repository operations section of the specification.
Copy/pasted here for ease of reference:
Seems right to me, yes. If there is a delegatee you want to delete, you should delete:
- The targets only the delegatee is responsible for.
- The delegatee's targets metadata.
- The delegation off any delegator's targets metadata.
But keep the snapshot metadata about (2) around until timestamp/snapshot needs to be reset (e.g., due to a fast-forward attack, as described in Section 5.3.11 of the spec).
(3) can safely be updated in the snapshot metadata so long as it doesn't rollback itself.
Originally posted by @trishankatdatadog in https://github.com/sigstore/root-signing/issues/546#issuecomment-1319169899
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.