Skip to content

Commit 202cd0a

Browse files
committed
Clarify repository operations
Signed-off-by: Marina Moore <mnm678@gmail.com>
1 parent 3dfd215 commit 202cd0a

1 file changed

Lines changed: 22 additions & 1 deletion

File tree

tap14.md

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,10 @@ period of time after upgrading. This grace period gives existing clients that
160160
implement old versions of the TUF specification time to implement support for a
161161
new specification version. Repositories achieve this using a directory structure
162162
with a directory for each supported TUF specification version. These directories
163-
contain metadata that supports the given TUF specification version. Using these
163+
contain metadata that supports the given TUF specification version. The
164+
repository may generate metadata for each directory using independent,
165+
version-specific code, or they may optimize when there is redundant metadata
166+
between different versions of the specification. Using these
164167
directories, a client is able to choose the most recent metadata they support.
165168
More details about this directory structure are contained in the [specification](#how-a-repository-updates).
166169
This TAP will also add a `supported_versions` field to root metadata so that the client
@@ -400,6 +403,24 @@ A repository should generate all TUF metadata, including root metadata, for all
400403
TUF versions that the repository supports. Any update to TUF targets or delegations should be reflected across
401404
all of these versions.
402405

406+
### Generating metadata for multiple specification versions
407+
408+
There are a couple of strategies that repositories MAY employ to generate TUF
409+
metadata for multiple specification versions. The simplest option is for
410+
repositories to keep a fork of the code that uses
411+
the old specification version, and generate all metadata for each specification
412+
version using both this fork and the latest code. For efficiency, repositories
413+
may instead re-generate only those metadata files that were effected by the
414+
breaking changes in the specification. For example, if version 3.0.0 introduces
415+
a new snapshot metadata format, a repository that supports major versions 2 and
416+
3 may generate all metadata using the latest version, then call just the
417+
functions from the version 2 code that are used to generate snapshot metadata.
418+
419+
For additional optimizations, the repository could any duplicate metadata files
420+
only once in the most recent specification version directory, then hard link
421+
to this copy from other directories. This strategy has been used to link
422+
duplicate metadata files used for consistent snapshots.
423+
403424
## Changes to TUF clients
404425

405426
TUF clients must store the TUF specification versions they support and may add

0 commit comments

Comments
 (0)