Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

possible blog post: Caching TUF metadata

オープン
  • 何か問題がありますか？
#2,605 コメント 3 件 リアクション 5 件 担当者 0 名 GitHub で見る

メンテナーはふだん 10 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
25/100
issue の種類
ドキュメント
明瞭さ
説明が足りない
活発さ
停滞
領域
content, documentation

調査の方向性

ファイル、テスト、コードのエントリーポイントは指定されていません。まず、貼り付けられた草稿と、ブログまたはドキュメントへの貢献に関するリポジトリのプロセスを確認し、その後、これを公開記事にするべきか、またどのような形式やレビューが必要かを明確にしてください。合意され、レビュー済みで、公開可能な記事が完成するか、進めないという判断が文書化されれば完了です。

索引モデルが issue の本文から書いたものです。

説明

I've spent far too long in the past week looking at CDN logs... I collected some notes from this, and wrote a first draft of a blog post or something. copy-pasting here so I don't lose it

TUF implementation details: Caching and content delivery networks

TUF metadata can be cached at various places during its lifetime, this post aims to describe the useful
methods of caching. The write-up assumes that the "consistent snapshot" feature of TUF is used:
this should be true for all reasonable implementations.

Client metadata cache

A TUF client stores downloaded metadata in an application cache as part of the
TUF Client Workflow. Note that caching metadata is subtly different from caching
artifacts: An artifact cache is a "pure" cache and can be purged at any time without
side-effects (other than possibly having to re-download). Purging the metadata cache
is also possible without service loss but does have minor security implications as
some rollback attack protection is lost.

Client HTTP cache

In addition to the actual metadata, a client could cache the ETag information
included in a timestamp.json response and use the If-None-Match header in
subsequent requests. This is not useful for other metadata or artifacts as they
should never change.

There is a minor information leak if this is done (as the server could now respond
maliciously to only some clients based on the content of the If-None-Match
header). Current client implementations are not known to cache ETag.

Content Delivery Network caching

One could imagine that caching something as simple as TUF metadata in a Content
Delivery Network (CDN) is a trivial feat but it turns out there are several pitfalls.

These are some of the lessons that have been learned while maintaining TUF repositories:

  • Uploading a new repository version to backend storage should be atomic (the metadata
    versions on the storage backend should always be consistent). If this is not technically possible,
    snapshot and all targets metadata should be uploaded before root and timestamp: this
    minimizes the window of potentially inconsistent metadata.
  • "Old" metadata (or artifact) versions should not be removed from backend storage immediately: this can break clients that are in the middle of an update process
  • CDN frontends should avoid serving any stale responses: 404 responses to root requests are part of the normal usage of the API and cannot be allowed to be stale, otherwise the repository state may be inconsistent.
  • CDN frontends may cache versioned positive metadata responses (root, snapshot, targets) with
    long lifetimes.
  • There are two valid alternatives to caching other responses:
    1. CDN frontend may use "negative cache" (caching failure codes) and may cache
      timestamp metadata responses, if it is able to invalidate the cache immediately on
      upload of new repository versions to storage backend.
    2. CDN frontend should not cache timestamp metadata responses or use "negative caching"
      if it is unable to invalidate the cache on upload of new data

At first glance it may seem like the above advice is overly cautious, and that failures
would be rare. In practice especially testing and alerting systems have managed to
consistently find failing combinations of mistakenly cached content.

主要言語
Python
スター
1.7k
フォーク
304
平均マージ
9時間 25分
マージ済み PR（30日）
14

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

theupdateframework/python-tuf のほかの issue

theupdateframework/python-tuf の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。