From 9cf3324fa8e8f1baad0ce67fda12b5d2fa4d42cd Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Mon, 14 Sep 2026 10:23:29 +1000 Subject: [PATCH 1/2] spec: only skip target roles if they appear in the same delegation path The previous wording implied that you should maintain a global list of roles walked and never walk into the same role even if the delegation paths were different, but this was not the original intention of this restriction -- the purpose was to just avoid cycles. Skipping later roles silently based on previous delegations can be somewhat dangerous because it could potentially allow a delegated role A to mask entries from a different delegated role B even if the delegation for role A does not permit it to publish a superset of role B's targets. In practice it seems unlikely this would be a practical security issue, but it's better to be safe than sorry and reduce the knock-on effects between delegations. This also makes it easier for tools to implement TUF extensions that list the set of available target files -- previously it would've been necessary to emulate what set of delegation path patterns could've reached an earlier delegation and invert them for later delegations, which is quite error-prone and leads to unexpected-to-the-user results. Signed-off-by: Aleksa Sarai --- tuf-spec.md | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/tuf-spec.md b/tuf-spec.md index 9f9d8f3..49fc0d6 100644 --- a/tuf-spec.md +++ b/tuf-spec.md @@ -1527,17 +1527,19 @@ it in the next step. 6. **Persist targets metadata**. The client MUST write the file to non-volatile storage as FILENAME.EXT (e.g. targets.json). -7. **Perform a pre-order depth-first search for metadata about the - desired target, beginning with the top-level targets role.** Note: If - any metadata requested in steps 5.6.7.1 - 5.6.7.2 cannot be downloaded nor - validated, end the search and report that the target cannot be found. - - 1. If this role has been visited before, then skip this role - (so that cycles in the delegation graph are avoided). Otherwise, if an - application-specific maximum number of roles have been visited, then go to - step [[#fetch-target]] (so that attackers cannot cause the client to waste excessive - bandwidth or time). Otherwise, if this role contains metadata about the - desired target, then go to step [[#fetch-target]]. +7. **Perform a pre-order depth-first search for metadata about the desired + target, beginning with the top-level targets role**, taking note of the + delegation path taken when walking into each role. Note: If any metadata + requested in steps 5.6.7.1 - 5.6.7.2 cannot be downloaded nor validated, end + the search and report that the target cannot be found. + + 1. If this role has been visited before in the delegation path used to reach + this role, then skip this role (so that cycles in the delegation graph are + avoided). Otherwise, if an application-specific maximum number of roles + have been visited, then go to step [[#fetch-target]] (so that attackers + cannot cause the client to waste excessive bandwidth or time). Otherwise, + if this role contains metadata about the desired target, then go to step + [[#fetch-target]]. 2. Otherwise, recursively search the list of delegations in order of appearance. From 399a9c0e2a2462fdbae87825906d5444dbc8c3fb Mon Sep 17 00:00:00 2001 From: Justin Cappos Date: Thu, 8 Oct 2026 10:28:41 -0400 Subject: [PATCH 2/2] Bump patch version number Co-authored-by: Justin Cappos Signed-off-by: Justin Cappos --- tuf-spec.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tuf-spec.md b/tuf-spec.md index 49fc0d6..8b0a571 100644 --- a/tuf-spec.md +++ b/tuf-spec.md @@ -3,7 +3,7 @@ Title: The Update Framework Specification Shortname: TUF Status: LS Abstract: A framework for securing software update systems. -Date: 2026-08-05 +Date: 2026-10-08 Editor: Justin Cappos, NYU Editor: Trishank Karthik Kuppusamy, Apple Editor: Joshua Lock, University of Lincoln @@ -16,7 +16,7 @@ Boilerplate: copyright no, conformance no Local Boilerplate: header yes Markup Shorthands: css no, markdown yes Metadata Include: This version off, Abstract off -Text Macro: VERSION 1.0.36 +Text Macro: VERSION 1.0.37 Note: We strive to make the specification easy to implement, so if you come