theupdateframework/specification

View on GitHub

The Update Framework specification

Stars: 405
Forks: 59
Open beginner issues: 0
Indexed issues: 79
Avg merge: 3d 4h
Merged PRs (30d): 1

Dominant language: Python
License: No license data
Last GitHub push: Sep 17, 2026
Latest indexed: Sep 19, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: good first issue help wanted

Beginner friendly Everything

Open All

79 open issues indexed

RFC: support recursive path pattern delegations Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#328 · 2 comments · Opened Sep 14, 2026
Two definitions of KEYID Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

theupdateframework/specification#323 · 1 reaction · Opened Aug 5, 2026
Problematic delegation walk restriction during "update the targets role" step Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

theupdateframework/specification#321 · 6 comments · Opened Aug 5, 2026
During root update, should we purge trusted timestamp/snapshot after key rotation earlier in the process? Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#318 · Opened Jul 7, 2026
feature: metadata repository visualization Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#312 · 25 comments · 4 reactions · Opened Feb 14, 2025
Add new keytype-scheme for prehash ? Open

Difficulty 5/5 Over a week Newbie friendliness 28/100

theupdateframework/specification#310 · 1 comment · 2 reactions · Opened Jan 14, 2025
Conflicting signature keyid uniqueness requirements Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#308 · 3 comments · Opened Aug 19, 2024
Create Issue Request and PR Template for Repository (tuf-specification) Open

Difficulty 2/5 1-3 hours Newbie friendliness 42/100

theupdateframework/specification#307 · 1 comment · Opened Jun 8, 2024
Loosen the keyid verification requirement? Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#305 · 3 comments · 4 reactions · Opened Apr 26, 2024
Inflexible and incomplete public key distribution formats Open

enhancement help wanted

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#302 · 5 comments · 2 reactions · Opened Mar 9, 2024
create-release action unmaintained Open

automation

Difficulty 3/5 1-2 days Newbie friendliness 35/100

theupdateframework/specification#280 · 2 comments · Opened May 15, 2023
Use formal methods to prove security properties Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

theupdateframework/specification#271 · 13 comments · 2 reactions · Opened Feb 17, 2023
How do TARGETS interact with delegations? Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#268 · 4 comments · 6 reactions · Opened Jan 15, 2023
Document delegation removal in repository operations Open

clarification good first issue

theupdateframework/specification#262 · 1 comment · 1 reaction · 1 assignee · Opened Nov 18, 2022
It would be really nice to have a collection of test data to test client conformance Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

theupdateframework/specification#260 · 6 comments · 2 reactions · Opened Oct 23, 2022
Repository operations: when to update metadata version Open

Difficulty 2/5 Half a day Newbie friendliness 45/100

theupdateframework/specification#253 · 1 reaction · Opened Sep 30, 2022
Does each of the root metadata roles require at least one keyid, and a threshold >= 1? Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

theupdateframework/specification#251 · 1 comment · 2 reactions · Opened Sep 24, 2022
FileMeta verification guidance with client store representations Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#249 · 2 comments · Opened Sep 15, 2022
It would be nice to have an OpenAPI or JSON Schema for TUF resource types Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#242 · 4 reactions · Opened Aug 12, 2022
root version comparison still unclear Open

clarification

Difficulty 3/5 1-2 days Newbie friendliness 45/100

theupdateframework/specification#240 · 2 comments · 2 reactions · Opened Aug 9, 2022
Clarify client workflow when no new metadata is available Open

clarification

Difficulty 4/5 3-5 days Newbie friendliness 25/100

theupdateframework/specification#235 · 1 comment · Opened Jun 13, 2022
chore: draft branch notoriously lagging behind Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#229 · 1 reaction · Opened May 24, 2022
Do we always need to download snapshot and targets? Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

theupdateframework/specification#227 · 7 comments · Opened May 19, 2022
avoid trying to update root role every time Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#225 · 3 comments · Opened May 10, 2022
Repository update races with clients Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#223 · 3 comments · Opened Apr 25, 2022
Correct and clarify "6.3.1 Updating targets metadata" for delegated targets roles Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#214 · 4 comments · 4 reactions · Opened Mar 28, 2022
Properly describe hashed bin delegation in the specification Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

theupdateframework/specification#210 · 6 comments · 2 reactions · Opened Feb 17, 2022
Add key compromise analysis section for top-level roles. Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 45/100

theupdateframework/specification#204 · 3 reactions · Opened Feb 4, 2022
Clarify key format Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#201 · 4 comments · Opened Jan 18, 2022
clarify paths vs path_hash_prefixes (once more) Open

question

Difficulty 5/5 Over a week Newbie friendliness 30/100

theupdateframework/specification#200 · 3 comments · 2 reactions · Opened Jan 12, 2022
Clarify fetching targets with multiple hashes if one is missing Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

theupdateframework/specification#199 · 4 comments · 1 reaction · Opened Dec 23, 2021
Clean-up/clarify how targets are fetched Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#198 · 2 comments · Opened Dec 14, 2021
Clarify when local copies of metadata should be loaded in order to support rollback checks Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#197 · Opened Dec 14, 2021
Tracking changes between specification releases Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#188 · 1 comment · Opened Oct 5, 2021
Repository workflows: document how a repository recovers from compromise Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

theupdateframework/specification#186 · 2 comments · Opened Sep 21, 2021
Delineating between security property requirements and internal consistency requirements in detailed client workflow Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#185 · 1 comment · Opened Sep 16, 2021
consistent targets is not well defined with regards to TARGETPATH Open

question

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#183 · Opened Sep 10, 2021
Describe and delineate "trusted metadata" Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

theupdateframework/specification#179 · 3 comments · Opened Aug 17, 2021
Clarify client traversal of role delegation graph Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#177 · 7 comments · 4 reactions · Opened Jul 20, 2021
Specification uses object terminology to describe data structures Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

theupdateframework/specification#175 · 1 comment · 2 reactions · Opened Jul 19, 2021
Clarify backwards-incompatible changes sentence Open

Difficulty 1/5 Under an hour Newbie friendliness 45/100

theupdateframework/specification#170 · Opened Jun 14, 2021
Confirm terminating roles logic from spec Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#168 · 10 comments · Opened Jun 9, 2021
Clarify the preorder DFS Open

Difficulty 1/5 Under an hour Newbie friendliness 58/100

theupdateframework/specification#164 · Opened May 28, 2021
Change data structure for signatures to use key IDs as dictionary keys Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#155 · 4 comments · Opened Apr 15, 2021
TUF metadata terminology pet peeves and rename suggestions Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

theupdateframework/specification#149 · 7 comments · 2 reactions · Opened Feb 15, 2021
Why filenames instead of rolenames in snapshot? Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#144 · 7 comments · Opened Dec 17, 2020
Is multi-role delegation in 1.0.0 or not? Open

question

Difficulty 5/5 Over a week Newbie friendliness 30/100

theupdateframework/specification#140 · 4 comments · Opened Dec 10, 2020
Are targets lengths optional or not? Open

question

Difficulty 5/5 Over a week Newbie friendliness 20/100

theupdateframework/specification#139 · 48 comments · Opened Dec 4, 2020
Introduce a notion of slack time to the update worfklow's fixed notion of time Open

enhancement

theupdateframework/specification#137 · 1 comment · 1 reaction · 1 assignee · Opened Dec 2, 2020
Should the TUF update workflow eventually succeed even if non-volatile storage writes always fails? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#131 · 3 comments · Opened Oct 28, 2020

theupdateframework/specification

Get new issues in your inbox