1
1
# <p align =" center " >The Update Framework Specification
2
2
3
- Last modified: ** 30 September 2020**
3
+ Last modified: ** 06 October 2020**
4
4
5
- Version: ** 1.0.10 **
5
+ Version: ** 1.0.11 **
6
6
7
7
We strive to make the specification easy to implement, so if you come across
8
8
any inconsistencies or experience any difficulty, do let us know by sending an
@@ -14,13 +14,13 @@ repo](https://github.com/theupdateframework/specification/issues).
14
14
15
15
## Table of Contents ##
16
16
- [ 1. Introduction] ( #1-introduction )
17
- - [ 2. System Overview ] ( #2-system-overview )
18
- - [ 3. The Repository ] ( #3-the-repository )
19
- - [ 4. Document Formats ] ( #4-document-formats )
20
- - [ 5. Detailed Workflows ] ( #5-detailed-workflows )
17
+ - [ 2. System overview ] ( #2-system-overview )
18
+ - [ 3. The repository ] ( #3-the-repository )
19
+ - [ 4. Document formats ] ( #4-document-formats )
20
+ - [ 5. Detailed workflows ] ( #5-detailed-workflows )
21
21
- [ 6. Usage] ( #6-usage )
22
- - [ 7. Consistent Snapshots ] ( #7-consistent-snapshots )
23
- - [ F. Future Directions and Open Questions ] ( #f-future-directions-and-open-questions )
22
+ - [ 7. Consistent snapshots ] ( #7-consistent-snapshots )
23
+ - [ F. Future directions and open questions ] ( #f-future-directions-and-open-questions )
24
24
25
25
## ** 1. Introduction**
26
26
* ** 1.1. Scope**
@@ -282,7 +282,7 @@ repo](https://github.com/theupdateframework/specification/issues).
282
282
All roles can use one or more keys and require a threshold of signatures of
283
283
the role's keys in order to trust a given metadata file.
284
284
285
- - ** 2.1.1. Root Role **
285
+ - ** 2.1.1. Root role **
286
286
287
287
+ The root role delegates trust to specific keys trusted for all other
288
288
top-level roles used in the system.
@@ -353,7 +353,7 @@ repo](https://github.com/theupdateframework/specification/issues).
353
353
security from being tricked into contacting the wrong mirrors. This is
354
354
because the framework has very little trust in repositories.
355
355
356
- * ** 2.2. Threat Model And Analysis **
356
+ * ** 2.2. Threat model and analysis **
357
357
358
358
We assume an adversary who can respond to client requests, whether by acting
359
359
as a man-in-the-middle or through compromising repository mirrors. At
@@ -1064,7 +1064,7 @@ repo](https://github.com/theupdateframework/specification/issues).
1064
1064
This behavior can be modified by the client code that uses the framework to,
1065
1065
for example, randomly select from the listed mirrors.
1066
1066
1067
- ## ** 5. Detailed Workflows **
1067
+ ## ** 5. Detailed workflows **
1068
1068
1069
1069
### ** The client application**
1070
1070
@@ -1309,7 +1309,7 @@ snapshot metadata file.
1309
1309
(e.g.,
1310
1310
c14aeb4ac9f4a8fc0d83d12482b9197452f6adf3eb710e3b1e2b79e8d14cb681.foobar.tar.gz),
1311
1311
where HASH is one of the hashes of the targets file listed in the targets
1312
- metadata file found earlier in step 4. In either case, the client MUST write
1312
+ metadata file found earlier in step 5. 4. In either case, the client MUST write
1313
1313
the file to non-volatile storage as FILENAME.EXT.
1314
1314
1315
1315
## ** 6. Usage**
@@ -1357,7 +1357,7 @@ snapshot metadata file.
1357
1357
just replaces that key with another in the signed metadata where the
1358
1358
delegation is done.
1359
1359
1360
- ## ** 7. Consistent Snapshots **
1360
+ ## ** 7. Consistent snapshots **
1361
1361
1362
1362
So far, we have considered a TUF repository that is relatively static (in
1363
1363
terms of how often metadata and target files are updated). The problem is
0 commit comments