From 5b6279e0125526629f1aab3abf7fb43295ed14c8 Mon Sep 17 00:00:00 2001 From: Aditya Sirish Date: Fri, 23 Feb 2024 16:39:11 -0500 Subject: [PATCH 1/5] Update wildcard pattern behavior This commit adds explicit examples of targets that are not matched by a wildcard. It also adds a note warning users that incorrect assumptions about wildcard behavior can potentially lead to an untrusted role signing for a target. Signed-off-by: Aditya Sirish --- tuf-spec.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/tuf-spec.md b/tuf-spec.md index 1eda0da..37f0a08 100644 --- a/tuf-spec.md +++ b/tuf-spec.md @@ -3,7 +3,7 @@ Title: The Update Framework Specification Shortname: TUF Status: LS Abstract: A framework for securing software update systems. -Date: 2023-04-14 +Date: 2024-02-23 Editor: Justin Cappos, NYU Editor: Trishank Karthik Kuppusamy, Datadog Editor: Joshua Lock, Verizon @@ -1093,8 +1093,17 @@ attributes are OPTIONAL, if used, exactly one of them should be set. `"foo-version-2.tgz"` and `"foo-version-a.tgz"`, but not `"foo-version-alpha.tgz"`. * a PATHPATTERN of `"*.tgz"` would match `"foo.tgz"` and `"bar.tgz"`, - but not `"targets/foo.tgz"` - * a PATHPATTERN of `"foo.tgz"` would match only `"foo.tgz"` + but not `"targets/foo.tgz"`. + * a PATHPATTERN of `"foo.tgz"` would match only `"foo.tgz"`. + * a PATHPATTERN of `"foo/*"` matches `"foo/bar.tgz"` but not + `"foo/baz/bar.tgz"`, `"foo/bar/baz/bar.tgz"`, and so on. + + Note: It is important to understand the functioning of path patterns to + avoid mistaken assumptions that can lead to a false sense of security. For + example, an assumption that `"foo/*"` applies recursively to all files in + subdirectories of `foo` in a terminating delegation could allow a subsequent + delegated role that should not be trusted to sign for a target. + Prioritized delegations allow clients to resolve conflicts between delegated From 461cfb601f8ecf2f0738918a54c2e7d6eb086488 Mon Sep 17 00:00:00 2001 From: Aditya Sirish Date: Fri, 23 Feb 2024 16:58:47 -0500 Subject: [PATCH 2/5] fixup! remind why this is important Signed-off-by: Aditya Sirish --- tuf-spec.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/tuf-spec.md b/tuf-spec.md index 37f0a08..db522fe 100644 --- a/tuf-spec.md +++ b/tuf-spec.md @@ -1098,11 +1098,13 @@ attributes are OPTIONAL, if used, exactly one of them should be set. * a PATHPATTERN of `"foo/*"` matches `"foo/bar.tgz"` but not `"foo/baz/bar.tgz"`, `"foo/bar/baz/bar.tgz"`, and so on. - Note: It is important to understand the functioning of path patterns to - avoid mistaken assumptions that can lead to a false sense of security. For - example, an assumption that `"foo/*"` applies recursively to all files in - subdirectories of `foo` in a terminating delegation could allow a subsequent - delegated role that should not be trusted to sign for a target. + Note: As each describes the paths that a delegated role is + trusted to provide, it is important to understand the functioning of path + patterns to avoid mistaken assumptions that can lead to a false sense of + security. For example, an assumption that `"foo/*"` applies recursively to + all files in subdirectories of `foo` in a terminating delegation could allow + a subsequent delegated role that should not be trusted to sign for a target + in a subdirectory of `foo`. From 4ed28cfdf3f7f1ea15963b08a91d560cb0ba35ce Mon Sep 17 00:00:00 2001 From: Aditya Sirish Date: Fri, 23 Feb 2024 17:05:16 -0500 Subject: [PATCH 3/5] fixup! version bump Signed-off-by: Aditya Sirish --- tuf-spec.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tuf-spec.md b/tuf-spec.md index db522fe..b987510 100644 --- a/tuf-spec.md +++ b/tuf-spec.md @@ -16,7 +16,7 @@ Boilerplate: copyright no, conformance no Local Boilerplate: header yes Markup Shorthands: css no, markdown yes Metadata Include: This version off, Abstract off -Text Macro: VERSION 1.0.33 +Text Macro: VERSION 1.0.34 Note: We strive to make the specification easy to implement, so if you come From eae85c611264d48ccc2f17d3879b0ef08cad0efd Mon Sep 17 00:00:00 2001 From: Joshua Lock Date: Wed, 5 Aug 2026 17:04:23 +0100 Subject: [PATCH 4/5] Apply suggestions from code review Move the comment on wildcards not applying recursively above the examples, so that it's a little more prominent. Co-authored-by: Joshua Lock Signed-off-by: Joshua Lock --- tuf-spec.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/tuf-spec.md b/tuf-spec.md index 47949d8..6ed8b22 100644 --- a/tuf-spec.md +++ b/tuf-spec.md @@ -1090,6 +1090,14 @@ attributes are OPTIONAL, if used, exactly one of them should be set. also recommended for TARGETPATH. A path separator in a path SHOULD NOT be matched by a wildcard in the PATHPATTERN. + Note: As each describes the paths that a delegated role is + trusted to provide, it is important to understand the functioning of path + patterns to avoid mistaken assumptions that can lead to a false sense of + security. For example, an assumption that `"foo/*"` applies recursively to + all files in subdirectories of `foo` in a terminating delegation could allow + a subsequent delegated role that should not be trusted to sign for a target + in a subdirectory of `foo`. + Some example PATHPATTERNs and expected matches: * a PATHPATTERN of `"targets/*.tgz"` would match file paths `"targets/foo.tgz"` and `"targets/bar.tgz"`, but not `"targets/foo.txt"`. @@ -1102,13 +1110,6 @@ attributes are OPTIONAL, if used, exactly one of them should be set. * a PATHPATTERN of `"foo/*"` matches `"foo/bar.tgz"` but not `"foo/baz/bar.tgz"`, `"foo/bar/baz/bar.tgz"`, and so on. - Note: As each describes the paths that a delegated role is - trusted to provide, it is important to understand the functioning of path - patterns to avoid mistaken assumptions that can lead to a false sense of - security. For example, an assumption that `"foo/*"` applies recursively to - all files in subdirectories of `foo` in a terminating delegation could allow - a subsequent delegated role that should not be trusted to sign for a target - in a subdirectory of `foo`. From a7fd3d23e70366cdffd44fcde7b2952ebe9caa35 Mon Sep 17 00:00:00 2001 From: Joshua Lock Date: Wed, 5 Aug 2026 17:10:41 +0100 Subject: [PATCH 5/5] Update tuf-spec.md Fix incorrect bikeshed syntax for a reference. Signed-off-by: Joshua Lock --- tuf-spec.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tuf-spec.md b/tuf-spec.md index 6ed8b22..a0567c4 100644 --- a/tuf-spec.md +++ b/tuf-spec.md @@ -1090,7 +1090,7 @@ attributes are OPTIONAL, if used, exactly one of them should be set. also recommended for TARGETPATH. A path separator in a path SHOULD NOT be matched by a wildcard in the PATHPATTERN. - Note: As each describes the paths that a delegated role is + Note: As each PATHPATTERN describes the paths that a delegated role is trusted to provide, it is important to understand the functioning of path patterns to avoid mistaken assumptions that can lead to a false sense of security. For example, an assumption that `"foo/*"` applies recursively to