Expired metadata for succinct roles

[rdimitrov]

I've been using this repo as part of the examples in rdimitrov/go-tuf-metadata and noticed that the metadata for the succinct roles needs to be regenerated as it had expired.

[rdimitrov]

ref: rdimitrov/go-tuf-metadata#54 (comment)

[jku]

I'm trying to decide what to do with this... I'd like to have one or two repositories that are good examples and have actual content changes but I'm not sure if I want to maintain this one as it is.

• this is built / maintained with repository-editor-for-tuf which is a fine tool for creating whatever metadata you want... but was not intended to be a repository maintenance tool
• tuf-on-ci is a repository maintenance system and we could switch this to be a tuf-on-ci maintained repo... but that tool does not, at least at this point, support all the things demonstrated in this repo (like succinct delegations)

Considering I don't know what to do, maybe the right path would be to just make the metadata be valid again...

• find the signing keys, I'm sure they're stored on some disk somewhere
• create new versions of metadata with 20yr expiry

That said, I do expect the online scripts to break at some point so in some ways this is band aid

[rdimitrov]

I agree 👍 If there's a way to automate the generation of succinct delegations as to how I believe the normal delegations are automated here it would suffice for the time being. Nevertheless, I was happy to see that it handled the expired metadata correctly and it failed.

On the other note, do you plan to add succinct roles to tuf-on-ci?

Now that I think about it - perhaps the way I use tuf-demo in go-tuf-metadata should be just another test case for the conformance testing rig.

[jku]

On the other note, do you plan to add succinct roles to tuf-on-ci?

I'm not opposed to it, but

• meaningful succinct delegations likely means online signed targets (because it means a large amount of artifacts and frequent signing) -- so it might be a larger change with significant user experience effect
• as long as no actual user is asking for this, it's likely not very high on priority list

[jku]

I think I will turn this into a TUF-on-CI maintained repository: I am going to need a long term example repository for that anyway and I don't want to maintain two. So that will mean the succinct delegations are going to go away.

[rdimitrov]

That makes sense 👍 I will update my use cases accordingly once you make that change.

Nevertheless, I think having a working example repo with succinct delegations has its use cases, but I agree it's not worth achieving it through tuf-on-ci, at least not until there's a better reason 👍

[jku]

Nevertheless, I think having a working example repo with succinct delegations has its use cases

Yes, if/when we have a conformance test suite, this should be included

[jku]

Closing as I just removed all metadata (this repository starts from scratch soon)