specification icon indicating copy to clipboard operation
specification copied to clipboard

It is probably not helpful for Timestamp to list Snapshot's hash

Open awwad opened this issue 7 years ago • 0 comments

Timestamp and Root are likely to be the two most-downloaded files on a repository. Currently, Timestamp lists information for Snapshot in a different way than Snapshot lists information for Targets and delegated targets files: timestamp lists the hash of snapshot in addition to the version number of snapshot. It is not clear that this is actually useful.

The costs to this are a few:

  • It adds size to the timestamp role file (one hash where timestamp would otherwise not contain hashes)
  • It makes the timestamp role file a little harder to read and understand.
  • It makes conceptually reconciling timestamp and snapshot definitions a bit harder for implementers / new folks.
  • It requires a bulkier and less intuitive programmatic representation (in formats.py and tuf_metadata_definitions.asn1).

Snapshot definition Timestamp definition

awwad avatar Aug 30 '18 19:08 awwad