Discussion of TAP 5: Setting URLs for roles in the root metadata file about taps

[heartsucker]

Based off the two issues I just linked above, it should be noted that the URLs field should be altered to not be a URL but also a path. This would allow simple relative paths on the all servers/mirrors. That is, every mirror might have the same directory structure and be identical, and in one line it could be noted that the root.json is under meta/root.json.

[JustinCappos]

I'm confused by what you are asking for. A URL can contain a path, right? https://en.wikipedia.org/wiki/URL

…

On Thu, Jun 22, 2017 at 9:56 AM, heartsucker ***@***.***> wrote: Based off the two issues I just linked above, it should be noted that the URLs field should be altered to not be a URL but also a path. This would allow simple relative paths on the all servers/mirrors. That is, every mirror might have the same directory structure and be identical, and in one line it could be noted that the root.json is under meta/root.json. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#34 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA0XD-U-gHmmtvLFgYQ5VOYAjVZ4P_NTks5sGnKkgaJpZM4NsF-r> .

[heartsucker]

Let's say I have repo tuf.example.com and it mirrors to tuf.foo.com and tuf.bar.com, but on all 3, I have the metadata served from meta/*.json and the targets are still from /. I want to be able to express that more simply. That is, all mirrors always have the metadata served from /meta. Doing it with the URLs notation would require each mirror to have separate roots that all point to $self/meta for the different pieces. This is more related to theupdateframework/python-tuf#463 than this issue itself, but I guess I wanted to express a perceived shortcoming here.

[vladimir-v-diaz]

@heartsucker Can you give us an example of the notation you'd like for TAP 5 to support?

Are you saying that the following is unwieldy, for example?

"root": {
         // Fix the root role to keys controlled by the group of enterprise
         // users instead of PyPI administrators.
        "keyids": [...],
        // And update the root metadata file from a privately controlled server.
        "URLs": ["http://tuf.example.com/metadata/root.json",
            "tuf.foo.com/metadata/root.json, "tuf.bar.com/metadata/root.json"],
        ...
      },

[mnm678]

Closing discussion for rejected TAP.