Skip to content

Add description of version number scalability #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lukpueh merged 5 commits into from
Nov 26, 2019
Merged

Add description of version number scalability #72

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9b3fd4a
add description of version number scalability
mnm678 Nov 20, 2019
d0deb7a
fix typos
mnm678 Nov 20, 2019
e48667b
explain snapshot revokation
mnm678 Nov 22, 2019
6b080bd
Update pep-0458.txt
mnm678 Nov 25, 2019
6584424
Clarify that an 8 byte integer is not required and reword the version…
mnm678 Nov 25, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pep-0458.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -828,6 +828,14 @@ version of the *snapshot* metadata, which in turn lists the versions of the
*targets* and delegated targets metadata, all as part of a given consistent
snapshot.

In normal usage, version number overflow is unlikely to occur. An 8-byte integer,
for instance, can be incremented once per millisecond and last almost 300 million
years. If an attacker increases the version number arbitrarily, the repository
can recover by revoking the compromised keys and resetting the version number as
described in the TUF specification__.

__ https://github.com/theupdateframework/specification/blame/4b82990afdc6c6d77aa9d43e0632f01bb9e7752c/tuf-spec.md#L1112-L1120

The *targets* or delegated targets metadata refer to the actual target
files, including all of their cryptographic hashes as specified above.
Thus, to mark a target file as part of a consistent snapshot it MUST, when
Expand Down