theupdateframework/specification

View on GitHub

The Update Framework specification

Stars: 405
Forks: 59
Open beginner issues: 0
Indexed issues: 79
Avg merge: 3d 4h
Merged PRs (30d): 1

Dominant language: Python
License: No license data
Last GitHub push: Sep 17, 2026
Latest indexed: Sep 19, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: good first issue help wanted

Beginner friendly Everything

Open All

79 open issues indexed

Clearly specify how to optionally defend against slow-retrieval attacks Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#124 · 3 comments · 4 reactions · Opened Oct 1, 2020
Rewriting the workflow to call out to sub-sections Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#121 · 6 comments · 6 reactions · Opened Sep 28, 2020
How should we handle metadata that has the same version but different content? Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

theupdateframework/specification#114 · 2 comments · Opened Sep 17, 2020
Guidance for [[transparent] proxy cache] partial mirrors? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#110 · Opened Aug 29, 2020
Documenting fundamental concepts Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

theupdateframework/specification#109 · 2 reactions · Opened Aug 28, 2020
How do we initialize trust with local metadata, and no access to a remote repository? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#108 · 3 comments · 1 reaction · Opened Aug 28, 2020
Is it safe to use a backstop metadata version when initializing trust? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#107 · 4 comments · 3 reactions · Opened Aug 26, 2020
Access control for TUF repositories Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#104 · 3 comments · Opened Jun 26, 2020
Remove file system requirements Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

theupdateframework/specification#103 · 6 comments · Opened Jun 9, 2020
Questions about min_roles_in_agreement and many to one delegations Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#96 · 1 comment · Opened Apr 17, 2020
Canonical JSON may not be valid JSON Open

Difficulty 1/5 Under an hour Newbie friendliness 35/100

theupdateframework/specification#92 · 4 comments · Opened Feb 26, 2020
Secondary literature with detailed rationale and recommendations Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#91 · 10 comments · Opened Feb 14, 2020
Ambiguity around rotating keys and deleting metadata Open

theupdateframework/specification#71 · 7 comments · 1 assignee · Opened Dec 4, 2019
How should clients handle interrupted updates? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#69 · 2 comments · 1 reaction · Opened Dec 3, 2019
What is the PEM encoding for RSA public keys? Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

theupdateframework/specification#48 · 2 comments · Opened Aug 7, 2019
Incomplete information (and inconsistent behaviour) about dealing with custom metadata matching Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#41 · 6 comments · Opened Apr 4, 2019
How to verify delegated targets files Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#32 · Opened Feb 11, 2019
Hint to enable caching of targets Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#30 · Opened Jan 18, 2019
It is probably not helpful for Timestamp to list Snapshot's hash Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

theupdateframework/specification#28 · Opened Aug 30, 2018
Prevent promiscuous delegations from violating security Open

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

theupdateframework/specification#19 · Opened Mar 23, 2018
Clarify meaning of "visited" in DFS target search Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

theupdateframework/specification#15 · Opened Feb 27, 2018
Unclear what asterisk means in delegation paths Open

question

Difficulty 3/5 1-2 days Newbie friendliness 35/100

theupdateframework/specification#208 · 2 comments · Opened Jul 6, 2017
Reference the map file in the specification (TAP4) Open

theupdateframework/specification#88 · 5 comments · 1 assignee · Opened May 24, 2017
Add section to TUF specification that covers key revocation Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#81 · Opened Apr 26, 2016
Backtracking semantics unclear in delegated roles Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#80 · 7 comments · Opened Nov 12, 2015
Client workflow lacks detail Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

theupdateframework/specification#79 · 1 comment · Opened Oct 23, 2015
Spec should be explicit about what happens when no locally cached snapshot is available Open

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

theupdateframework/specification#78 · 1 comment · Opened May 15, 2015
Spec doesn't say what happens to locally cached files when root metadata is changed Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#77 · 2 comments · Opened May 15, 2015
Spec should say when 'local' files are overwritten (5.1) Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

theupdateframework/specification#76 · 8 comments · Opened May 14, 2015

theupdateframework/specification

Get new issues in your inbox