@@ -3,7 +3,7 @@ Title: The Update Framework Specification
33Shortname: TUF
44Status: LS
55Abstract: A framework for securing software update systems.
6- Date: 2021-09-21
6+ Date: 2021-12-14
77Editor: Justin Cappos, NYU
88Editor: Trishank Karthik Kuppusamy, Datadog
99Editor: Joshua Lock, VMware
@@ -16,7 +16,7 @@ Boilerplate: copyright no, conformance no
1616Local Boilerplate: header yes
1717Markup Shorthands: css no, markdown yes
1818Metadata Include: This version off, Abstract off
19- Text Macro: VERSION 1.0.26
19+ Text Macro: VERSION 1.0.27
2020</pre >
2121
2222Note: We strive to make the specification easy to implement, so if you come
@@ -216,13 +216,13 @@ when a client is unable to update.
216216
217217### TUF Augmentation Proposal (TAP) support ### {#tuf-augmentation-proposal-tap-support}
218218
219- This major version (1.x.y) of the specification adheres to the following TAPS :
219+ This major version (1.x.y) of the specification adheres to the following TAPs :
220220
221221- [ TAP 6] ( https://github.com/theupdateframework/taps/blob/master/tap6.md ) :
222222 Include specification version in metadata
223223- [ TAP 9] ( https://github.com/theupdateframework/taps/blob/master/tap9.md ) :
224224 Mandatory Metadata signing schemes
225- - [ Tap 10] ( https://github.com/theupdateframework/taps/blob/master/tap10.md ) :
225+ - [ TAP 10] ( https://github.com/theupdateframework/taps/blob/master/tap10.md ) :
226226 Remove native support for compressed metadata
227227- [ TAP 11] ( https://github.com/theupdateframework/taps/blob/master/tap11.md ) :
228228 Using POUFs for Interoperability
@@ -399,7 +399,7 @@ publicly available in the [TAP directory](https://github.com/theupdateframework/
399399
400400An application uses the framework to interact with one or more repositories.
401401A repository is a conceptual source of target files of interest to the
402- application. Each repository has one or more mirrors which are the actual
402+ application. Each repository MAY have one or more mirrors as the
403403providers of files to be downloaded. For example, each mirror may specify a
404404different host where files can be downloaded from over HTTP.
405405
@@ -430,6 +430,13 @@ a repository are not specified by the framework. The names of these files
430430and directories are completely at the discretion of the application using
431431the framework.
432432
433+ However, when <a >CONSISTENT_SNAPSHOT</a >s are in use, there is a RECOMMENDED
434+ mechanism for naming target files on the repository (see
435+ [[ #consistent-snapshots]] ). If an application using the framework does not
436+ follow these recommendations, but wishes to support self-contained consistent
437+ snapshots the application MUST ensure that target files are persisted in a way
438+ where each target file can be uniquely and consistently addressed.
439+
433440### Metadata files ### {#metadata-files}
434441
435442The filenames and directory structure of repository metadata are strictly
0 commit comments