{"action":"created","issue":{"url":"https://api.github.com/repos/theupdateframework/taps/issues/37","repository_url":"https://api.github.com/repos/theupdateframework/taps","labels_url":"https://api.github.com/repos/theupdateframework/taps/issues/37/labels{/name}","comments_url":"https://api.github.com/repos/theupdateframework/taps/issues/37/comments","events_url":"https://api.github.com/repos/theupdateframework/taps/issues/37/events","html_url":"https://github.com/theupdateframework/taps/issues/37","id":232675502,"node_id":"MDU6SXNzdWUyMzI2NzU1MDI=","number":37,"title":"Discussion of TAP 8: Key rotation and explicit self-revocation","user":{"login":"vladimir-v-diaz","id":3520883,"node_id":"MDQ6VXNlcjM1MjA4ODM=","avatar_url":"https://avatars2.githubusercontent.com/u/3520883?v=4","gravatar_id":"","url":"https://api.github.com/users/vladimir-v-diaz","html_url":"https://github.com/vladimir-v-diaz","followers_url":"https://api.github.com/users/vladimir-v-diaz/followers","following_url":"https://api.github.com/users/vladimir-v-diaz/following{/other_user}","gists_url":"https://api.github.com/users/vladimir-v-diaz/gists{/gist_id}","starred_url":"https://api.github.com/users/vladimir-v-diaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vladimir-v-diaz/subscriptions","organizations_url":"https://api.github.com/users/vladimir-v-diaz/orgs","repos_url":"https://api.github.com/users/vladimir-v-diaz/repos","events_url":"https://api.github.com/users/vladimir-v-diaz/events{/privacy}","received_events_url":"https://api.github.com/users/vladimir-v-diaz/received_events","type":"User","site_admin":false},"labels":[{"id":438545191,"node_id":"MDU6TGFiZWw0Mzg1NDUxOTE=","url":"https://api.github.com/repos/theupdateframework/taps/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2017-05-31T19:48:08Z","updated_at":"2018-10-04T20:10:29Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"TAP 8 proposal is available at https://github.com/theupdateframework/taps/blob/master/tap8.md\r\n\r\nPull requests related to TAP 8:\r\nhttps://github.com/theupdateframework/taps/pull/20\r\n\r\nDiscussion of TAP 8 on the TUF mailing list:\r\nhttps://groups.google.com/d/msg/theupdateframework/Yj1z3PkMRZc/n8wXM4VZBgAJ"},"comment":{"url":"https://api.github.com/repos/theupdateframework/taps/issues/comments/427152935","html_url":"https://github.com/theupdateframework/taps/issues/37#issuecomment-427152935","issue_url":"https://api.github.com/repos/theupdateframework/taps/issues/37","id":427152935,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzE1MjkzNQ==","user":{"login":"JustinCappos","id":857871,"node_id":"MDQ6VXNlcjg1Nzg3MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/857871?v=4","gravatar_id":"","url":"https://api.github.com/users/JustinCappos","html_url":"https://github.com/JustinCappos","followers_url":"https://api.github.com/users/JustinCappos/followers","following_url":"https://api.github.com/users/JustinCappos/following{/other_user}","gists_url":"https://api.github.com/users/JustinCappos/gists{/gist_id}","starred_url":"https://api.github.com/users/JustinCappos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JustinCappos/subscriptions","organizations_url":"https://api.github.com/users/JustinCappos/orgs","repos_url":"https://api.github.com/users/JustinCappos/repos","events_url":"https://api.github.com/users/JustinCappos/events{/privacy}","received_events_url":"https://api.github.com/users/JustinCappos/received_events","type":"User","site_admin":false},"created_at":"2018-10-04T20:10:29Z","updated_at":"2018-10-04T20:10:29Z","author_association":"MEMBER","body":"I think there is another option for spec file changes --- require a version\nof the file with the old spec number (and of course in the old format) that\ntells clients where to get a version of the client so they can update.\n\nI don't think this is a TAP 8 problem though.  This feels like something\nthat should be pulled out into another TAP.\n\nI don't really understand what you mean in the pooling rotate files part.\nPerhaps this is because I think you're imagining cases where there are\nmultiple keys per role.  Can we start from the single key per role case and\nbuild up from there?\n\n\n\nOn Thu, Oct 4, 2018 at 2:30 PM mnm678 <notifications@github.com> wrote:\n\n> Root rotation\n>\n> I agree that we should leave the root rotation as is. There doesn’t seem\n> to be a good way to ensure rotate files are found for root, and\n> additionally the spec-version, etc in root should be read for each version\n> of the root file, which makes more sense with the current mechanism.\n>\n> Location of rotate files\n>\n> I think putting them in their own directory makes sense. The main issue\n> here is making sure that the client sees any available rotate files.\n>\n> Spec-version update\n>\n> While looking at root key rotation, it seems like what to do on a\n> spec-version update is not made clear. I’ve come up with a couple of ideas\n> here, and I think the second makes more sense for most uses.\n>\n> 1: Require all changes to be backwards compatible. This allows clients and\n> servers to update independently, but I think it creates more problems than\n> it solves because it limits the potential of TUF going forward. TAP 8,\n> along with other proposed changes would break on older versions.\n>\n> 2: Require clients to update. Specify that as soon as they see an increase\n> in the spec-version, they must update their client to finish the update\n> process. This might cause problems if the client for some reason\n> can’t/doesn’t want to update, but it allows for more flexibility and\n> potential security fixes in TUF.\n>\n> Pooling Rotate Files\n>\n> I think that they should be dependent on the role. The use case of a\n> person entering/leaving a role makes the most sense if the rotate file only\n> applies to that role in that repository. That way if person A left a role,\n> they would still have access to their other roles. However, it might be\n> nice if the self-revocation worked across repos.\n>\n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/theupdateframework/taps/issues/37#issuecomment-427123266>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AA0XDytwWIQW-9ykutvNZPdinZaX9Slfks5uhlO0gaJpZM4NsGtG>\n> .\n>\n"}}
{"actor":{"display_login":"JustinCappos"}}