@@ -160,7 +160,10 @@ period of time after upgrading. This grace period gives existing clients that
160160implement old versions of the TUF specification time to implement support for a
161161new specification version. Repositories achieve this using a directory structure
162162with a directory for each supported TUF specification version. These directories
163- contain metadata that supports the given TUF specification version. Using these
163+ contain metadata that supports the given TUF specification version. The
164+ repository may generate metadata for each directory using independent,
165+ version-specific code, or they may optimize when there is redundant metadata
166+ between different versions of the specification. Using these
164167directories, a client is able to choose the most recent metadata they support.
165168More details about this directory structure are contained in the [ specification] ( #how-a-repository-updates ) .
166169This TAP will also add a ` supported_versions ` field to root metadata so that the client
@@ -400,6 +403,24 @@ A repository should generate all TUF metadata, including root metadata, for all
400403TUF versions that the repository supports. Any update to TUF targets or delegations should be reflected across
401404all of these versions.
402405
406+ ### Generating metadata for multiple specification versions
407+
408+ There are a couple of strategies that repositories MAY employ to generate TUF
409+ metadata for multiple specification versions. The simplest option is for
410+ repositories to keep a fork of the code that uses
411+ the old specification version, and generate all metadata for each specification
412+ version using both this fork and the latest code. For efficiency, repositories
413+ may instead re-generate only those metadata files that were effected by the
414+ breaking changes in the specification. For example, if version 3.0.0 introduces
415+ a new snapshot metadata format, a repository that supports major versions 2 and
416+ 3 may generate all metadata using the latest version, then call just the
417+ functions from the version 2 code that are used to generate snapshot metadata.
418+
419+ For additional optimizations, the repository could any duplicate metadata files
420+ only once in the most recent specification version directory, then hard link
421+ to this copy from other directories. This strategy has been used to link
422+ duplicate metadata files used for consistent snapshots.
423+
403424## Changes to TUF clients
404425
405426TUF clients must store the TUF specification versions they support and may add
0 commit comments