timestamp must only refer to the snapshot metadata

erickt · web-flow · commit 79522c5000e7 · 2019-08-14T17:33:23.000-07:00
@JustinCappos in theupdateframework/rust-tuf#207 (comment) recommended that the timestamp role should only allow a reference to the snapshot metadata, and no other roles.
diff --git a/tuf-spec.md b/tuf-spec.md
@@ -928,8 +928,8 @@ repo](https://github.com/theupdateframework/specification/issues).
        }
 
    METAFILES is the same is described for the snapshot.json file.  In the case
-   of the timestamp.json file, this will commonly only include a description of
-   the snapshot.json file.
+   of the timestamp.json file, this MUST only include a description of the
+   snapshot.json file.
 
    A signed timestamp.json example file:
 

Original file line number	Diff line number	Diff line change
`@@ -928,8 +928,8 @@ repo](https://github.com/theupdateframework/specification/issues).`
`928`	`928`	`}`
`929`	`929`
`930`	`930`	`METAFILES is the same is described for the snapshot.json file. In the case`
`931`		`- of the timestamp.json file, this will commonly only include a description of`
`932`		`- the snapshot.json file.`
	`931`	`+ of the timestamp.json file, this MUST only include a description of the`
	`932`	`+ snapshot.json file.`
`933`	`933`
`934`	`934`	`A signed timestamp.json example file:`
`935`	`935`