{"action":"created","issue":{"url":"https://api.github.com/repos/docker/notary/issues/835","repository_url":"https://api.github.com/repos/docker/notary","labels_url":"https://api.github.com/repos/docker/notary/issues/835/labels{/name}","comments_url":"https://api.github.com/repos/docker/notary/issues/835/comments","events_url":"https://api.github.com/repos/docker/notary/issues/835/events","html_url":"https://github.com/docker/notary/issues/835","id":165640267,"number":835,"title":"Old public keys should be stored in versioned metadata, not roles","user":{"login":"ecordell","id":58055,"avatar_url":"https://avatars.githubusercontent.com/u/58055?v=3","gravatar_id":"","url":"https://api.github.com/users/ecordell","html_url":"https://github.com/ecordell","followers_url":"https://api.github.com/users/ecordell/followers","following_url":"https://api.github.com/users/ecordell/following{/other_user}","gists_url":"https://api.github.com/users/ecordell/gists{/gist_id}","starred_url":"https://api.github.com/users/ecordell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ecordell/subscriptions","organizations_url":"https://api.github.com/users/ecordell/orgs","repos_url":"https://api.github.com/users/ecordell/repos","events_url":"https://api.github.com/users/ecordell/events{/privacy}","received_events_url":"https://api.github.com/users/ecordell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":16,"created_at":"2016-07-14T19:32:21Z","updated_at":"2016-08-17T19:25:06Z","closed_at":null,"body":"Currently, rotating root keys versions the role and keeps the old keys around in the metadata indefinitely. Here's a quick example after adding two root keys:\r\n\r\nroot.json\r\n```json\r\n{\r\n\t\"signed\": {\r\n\t\t\"_type\": \"Root\",\r\n\t\t\"consistent_snapshot\": false,\r\n\t\t\"expires\": \"2026-07-10T15:54:46.480499158-04:00\",\r\n\t\t\"keys\": {\r\n\t\t\t\"072c38acffb2309e45bb942cfbd44d15a644b303713dda5dd0f2af25c71a6a7a\": {\r\n\t\t\t\t\"keytype\": \"ed25519\",\r\n\t\t\t\t\"keyval\": {\r\n\t\t\t\t\t\"private\": null,\r\n\t\t\t\t\t\"public\": \"uuyVXZHUGX3Sau6Yk3rC6mK2fq2fXODgKwXj8jkOo6I=\"\r\n\t\t\t\t}\r\n\t\t\t},\r\n\t\t\t\"117e3e9ccce8a85a236c2156b1729e57ebd427b544a65c9dfa2d2145c64534e9\": {\r\n\t\t\t\t\"keytype\": \"ecdsa\",\r\n\t\t\t\t\"keyval\": {\r\n\t\t\t\t\t\"private\": null,\r\n\t\t\t\t\t\"public\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcl5LAZXA5VLrKq5t+EzcWyskVOyTIANtqh4r0znfE+Qv867Lbx29vlU6A1BsoWtQGORIotzJ78aSbu5DWPCVgQ==\"\r\n\t\t\t\t}\r\n\t\t\t},\r\n\t\t\t\"5ccfcc693384568483aa960453b9e13fbb5d10d5251f1ab5ed5fc76c58d7372e\": {\r\n\t\t\t\t\"keytype\": \"ecdsa-x509\",\r\n\t\t\t\t\"keyval\": {\r\n\t\t\t\t\t\"private\": null,\r\n\t\t\t\t\t\"public\": \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJaekNDQVF5Z0F3SUJBZ0lSQUttbTF5R0VJZlIxa3ZZcldjWmJNYXd3Q2dZSUtvWkl6ajBFQXdJd0dURVgKTUJVR0ExVUVBeE1PY1hWaGVTOTBaWE4wTVRVNU16a3dIaGNOTVRZd056RXlNVGsxTkRRMFdoY05Nall3TnpFdwpNVGsxTkRRMFdqQVpNUmN3RlFZRFZRUURFdzV4ZFdGNUwzUmxjM1F4TlRrek9UQlpNQk1HQnlxR1NNNDlBZ0VHCkNDcUdTTTQ5QXdFSEEwSUFCSjRodWx6VmxETnZSS1ZYN1RZVytCeUNNdEFWNnlDZkI0Ymp1MXVZWlkwcUhRcU4KYkxORmRhblRLN2VlMmx2bVowalRuS3ZoMGVTZE5reFh2VThjbWhLak5UQXpNQTRHQTFVZER3RUIvd1FFQXdJRgpvREFUQmdOVkhTVUVEREFLQmdnckJnRUZCUWNEQXpBTUJnTlZIUk1CQWY4RUFqQUFNQW9HQ0NxR1NNNDlCQU1DCkEwa0FNRVlDSVFEbzlnTkhkSU5JZzFhN1BMcGQ1ZE1pcU1WMlRubzNVcEg1NTdWaVVvYTF5Z0loQU1JemcrM1YKcG5HcGRYTURFWkx5cnhGWHYzOURaUVdsTGlZbjd4K0x2d2FtCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\"\r\n\t\t\t\t}\r\n\t\t\t},\r\n\t\t\t\"86958cab1fb3cbaeae393fe7b7af3109adf627effc8e0ba39e23b185d266c61e\": {\r\n\t\t\t\t\"keytype\": \"ecdsa\",\r\n\t\t\t\t\"keyval\": {\r\n\t\t\t\t\t\"private\": null,\r\n\t\t\t\t\t\"public\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIowYCNsTPsmTkA4WzO5VdwOtVs3AZJnkW2pdPIKa30uB/oURJGx6gMGfuv3yZEu87hlVUOXT2DpIIRJIcyru5A==\"\r\n\t\t\t\t}\r\n\t\t\t},\r\n\t\t\t\"997c16ec6386ae57914a69983c712a05fa6382e4826251e9283c2cda21186045\": {\r\n\t\t\t\t\"keytype\": \"ecdsa\",\r\n\t\t\t\t\"keyval\": {\r\n\t\t\t\t\t\"private\": null,\r\n\t\t\t\t\t\"public\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEp5vDm97fT4AnrqS7qmcTrE7Mu4aeFIVAGXU9k3kigWALgRQ9c+g+FLeX4hxd3vJwOd7JjaSsalAyZC/wDduDGw==\"\r\n\t\t\t\t}\r\n\t\t\t},\r\n\t\t\t\"ca35263785be4f26f01d216c6f6238810c9ea997f35dcd2bbfc812a94e492278\": {\r\n\t\t\t\t\"keytype\": \"ecdsa\",\r\n\t\t\t\t\"keyval\": {\r\n\t\t\t\t\t\"private\": null,\r\n\t\t\t\t\t\"public\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZMTJCaBeOdWis/ZtnX30W+TTuYBRz7dGIhTH5zGAlVcK1gY6qOKDJWtI6Nvuo73xsvKIpPXP2CkxhNCq16L66Q==\"\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t},\r\n\t\t\"roles\": {\r\n\t\t\t\"root\": {\r\n\t\t\t\t\"keyids\": [\r\n\t\t\t\t\t\"5ccfcc693384568483aa960453b9e13fbb5d10d5251f1ab5ed5fc76c58d7372e\",\r\n\t\t\t\t\t\"117e3e9ccce8a85a236c2156b1729e57ebd427b544a65c9dfa2d2145c64534e9\",\r\n\t\t\t\t\t\"997c16ec6386ae57914a69983c712a05fa6382e4826251e9283c2cda21186045\"\r\n\t\t\t\t],\r\n\t\t\t\t\"threshold\": 1\r\n\t\t\t},\r\n\t\t\t\"root.1\": {\r\n\t\t\t\t\"keyids\": [\r\n\t\t\t\t\t\"5ccfcc693384568483aa960453b9e13fbb5d10d5251f1ab5ed5fc76c58d7372e\"\r\n\t\t\t\t],\r\n\t\t\t\t\"threshold\": 1\r\n\t\t\t},\r\n\t\t\t\"root.2\": {\r\n\t\t\t\t\"keyids\": [\r\n\t\t\t\t\t\"5ccfcc693384568483aa960453b9e13fbb5d10d5251f1ab5ed5fc76c58d7372e\",\r\n\t\t\t\t\t\"117e3e9ccce8a85a236c2156b1729e57ebd427b544a65c9dfa2d2145c64534e9\"\r\n\t\t\t\t],\r\n\t\t\t\t\"threshold\": 1\r\n\t\t\t},\r\n\t\t\t\"snapshot\": {\r\n\t\t\t\t\"keyids\": [\r\n\t\t\t\t\t\"ca35263785be4f26f01d216c6f6238810c9ea997f35dcd2bbfc812a94e492278\"\r\n\t\t\t\t],\r\n\t\t\t\t\"threshold\": 1\r\n\t\t\t},\r\n\t\t\t\"targets\": {\r\n\t\t\t\t\"keyids\": [\r\n\t\t\t\t\t\"86958cab1fb3cbaeae393fe7b7af3109adf627effc8e0ba39e23b185d266c61e\"\r\n\t\t\t\t],\r\n\t\t\t\t\"threshold\": 1\r\n\t\t\t},\r\n\t\t\t\"timestamp\": {\r\n\t\t\t\t\"keyids\": [\r\n\t\t\t\t\t\"072c38acffb2309e45bb942cfbd44d15a644b303713dda5dd0f2af25c71a6a7a\"\r\n\t\t\t\t],\r\n\t\t\t\t\"threshold\": 1\r\n\t\t\t}\r\n\t\t},\r\n\t\t\"version\": 3\r\n\t},\r\n\t\"signatures\": [{\r\n\t\t\"keyid\": \"5ccfcc693384568483aa960453b9e13fbb5d10d5251f1ab5ed5fc76c58d7372e\",\r\n\t\t\"method\": \"ecdsa\",\r\n\t\t\"sig\": \"GEe8atrsRO5fy5dhcYQlsV0K2sr+Uwum1utBBViLLqTEdsYXGLPN6dWgpMQU8y6U4J/WvqV43xnMRLxaBmXwvw==\"\r\n\t}]\r\n}\r\n```\r\n\r\nI think the older keys should be available in `root.2.json` and `root.1.json`, not as additional roles on a single `root.json` file. This way clients that have older metadata can request intermediate metadata to become current. \r\n\r\nI saw the discussion on #267 and #648, but I don't think this implementation follows TUF. I wanted to bring this up for discussion before working on it, since it would be a breaking change."},"comment":{"url":"https://api.github.com/repos/docker/notary/issues/comments/240519609","html_url":"https://github.com/docker/notary/issues/835#issuecomment-240519609","issue_url":"https://api.github.com/repos/docker/notary/issues/835","id":240519609,"user":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"created_at":"2016-08-17T19:25:06Z","updated_at":"2016-08-17T19:25:06Z","body":"Oops, sorry, I thought I had hit \"comment\" - no one is working on it yet.  :)"}}
{"actor":{"display_login":"cyli"}}