theupdateframework / theupdateframework/specification
Conflicting signature keyid uniqueness requirements
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 405
- Forks
- 59
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 1
Description
This paragraph from the metadata format section ...
The keyid MUST be unique in the "signatures" array: multiple
signatures with the same keyid are not allowed.
... seems to conflict with these paragraphs from the metadata format section ...
Note: The "signatures" list SHOULD only contain one SIGNATURE per
KEYID. This helps prevent multiple signatures by the same key
... and the client workflow section ...
Even if a KEYID is listed more than once in the
"signatures" list a client MUST NOT count more than one verified
SIGNATURE from that KEYID towards the THRESHOLD.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the metadata format section and client workflow section of tuf-spec.md at the linked lines. Compare the MUST, SHOULD, and client-verification statements about duplicate keyids, then determine the consistent requirement for the specification. Done means the relevant passages no longer conflict and the signature uniqueness behavior is unambiguous.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100