appc/spec

Evaluate The Update Framework

Open

#211 opened on Feb 19, 2015

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Go (143 forks)github user discovery
area/speccomponent/discoveryhelp wanted

Repository metrics

Stars
 (1,253 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Yesterday @titanous told me we should take a second look at The Update Framework (TUF) for addressing a number of things around the signing that we have wanted including: prevention of downgrade (#168), multiple signers, and key revocation.

There is a go implementation that we can look at over here: https://github.com/flynn/go-tuf

Things that need to be explored:

  • how do we support this as an alternative to GPG signing which is super simple and easy for developers to use?
  • how do we make it easy for a user to maintain a repo of images?
  • how does this impact the current SPEC around discovery?

Helpful blog series to explain the basics:

Contributor guide

Research direction
Read the TUF specification and blog posts linked in the issue to understand TUF's features. Explore the go tuf implementation and consider how it could replace GPG signing for container images. Document how TUF addresses downgrade prevention, multi signer support, and key revocation. Analyze the impact on the current SPEC discovery mechanism.
Tech stack
go
Domain
securitybackend
Issue type
Research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Go
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60