Incomplete information (and inconsistent behaviour) about dealing with custom metadata matching

Sometimes, we need to check targets metadata from different sources, and make sure that the metadata from all sources matches. There are two broad cases where this is necessary: Multi-role delegations (TAP-3), and multi-repository consensus (TAP-4 use case 3).

In both cases, the TAP specifies that only the non-custom metadata must match, but does not provide any guidance about what to do with custom metadata in case it differs.

The reference implementation of the client exhibits inconsistent behaviour between the two cases: in the multi-repo (TAP-4) case, it creates directories for each repository and saves the complete targets metadata from each; custom metadata is not checked. In the multi-role (TAP-3) case, it finds a consensus group according to the specified behaviour, then returns and saves only the metadata (custom and non-custom) from the highest-priority role in the consensus group (based on the standard pre-order DFS).

Start by reading TAP-3 and the TAP-4 use case 3 linked in the issue, then compare the described multi-repository and multi-role behaviors in the reference client. Done means the specification clearly defines how differing custom metadata should be handled consistently in both cases.