Merge branch 'master' into add-pattern-warnings

Signed-off-by: Joshua Lock <jlock@vmware.com>

Author: joshuagl

.github/workflows/draft.yml

@@ -12,7 +12,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
       with:
-        python-version: '3.10'
+        python-version: '3.14'
         cache: pip
 
     - name: Clone

.github/workflows/pr.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   main:
     name: Sanity checks before a PR merge
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
         with:
@@ -16,7 +16,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
-          python-version: '3.10'
+          python-version: '3.14'
           cache: pip
 
       - name: Ensure changes build

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       if: steps.getver.outputs.spec_version != steps.prevver.outputs.prev_version
       uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
       with:
-        python-version: '3.10'
+        python-version: '3.14'
         cache: 'pip'
 
     - name: Make release

MAINTAINERS.md

@@ -8,6 +8,7 @@
 
 * Justin Cappos ([JustinCappos](https://github.com/JustinCappos))
 * Trishank Karthik Kuppusamy ([trishankatdatadog](https://github.com/trishankatdatadog))
+* John Kjell ([jkjell](https://github.com/jkjell))
 * Joshua Lock ([joshuagl](https://github.com/joshuagl))
 * Marina Moore ([mnm678](https://github.com/mnm678))
 * Lukas Pühringer ([lukpueh](https://github.com/lukpueh))

README.rst

@@ -91,3 +91,11 @@ under Grant Nos. CNS-1345049 and CNS-0959138. Any opinions, findings, and
 conclusions or recommendations expressed in this material are those of the
 author(s) and do not necessarily reflect the views of the National Science
 Foundation.
+
+Governance & Licensing
+----------------------
+
+- `Scope <governance/02-scope.md>`_
+- `Notices <governance/03-notices.md>`_
+- `License <governance/04-license.md>`_
+- `Governance <governance/05-governance.md>`_

governance/00-contributor-license-agreement.md

@@ -0,0 +1,18 @@
+# Community Specification Contributor License Agreement 1.0
+
+By making a Contribution to this repository, I agree to the terms of the following documents located at [https://github.com/CommunitySpecification/1.0](https://github.com/CommunitySpecification/1.0):
+
+(a) Community Specification License 1.0 (.0_Community_Specification_License-v1.md)
+
+(b) Community Specification Governance Policy 1.0 (5._Governance.md)
+
+(c) Community Specification Contribution Policy 1.0 (6._Contributing.md)
+
+(d) Community Specification Code of Conduct (8._Code_of_Conduct.md)
+
+
+In addition, for source code contributions, I certify that:
+
+(a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or (b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it. (d) I understand and agree that this working group and the contribution may be public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this agreement or the open source license(s) involved.
+
+I represent that I am legally entitled to make the grants set forth in the documents above.  If my employer(s) has rights to intellectual property that may be infringed by the materials developed by this Working Group, I represent that I have received permission to enter these agreements on behalf of that employer.

governance/01-community-specification-license-v1.md

@@ -0,0 +1,23 @@
+# Scope of The Update Framework (TUF) Specification Working Group
+
+## 1. Objective
+The objective of The Update Framework (TUF) Working Group is to define, standardize, and maintain a framework for securing software update systems, specifically mitigating known attacks against software repositories (e.g., rollback, freeze, mix-and-match, and malicious repository compromises).
+
+## 2. In Scope
+The Working Group's standard-setting activities are strictly limited to the following areas required to achieve client-server interoperability:
+
+* **Metadata Data Models and Schemas:** The structure, syntax, semantics, and serialization formats (e.g., canonical JSON) of the core TUF metadata roles (Root, Targets, Snapshot, Timestamp) and any standardized extension roles.
+* **Client Verification Workflow:** The step-by-step state machine, algorithmic logic, and failure conditions a client must execute to securely fetch, validate, and process repository metadata and target files.
+* **Delegation and Trust Boundaries:** Mechanisms for threshold signing, cryptographic key delegation, repository segmentation, and key revocation within the metadata structure.
+* **Cryptographic Representation:** The specifications for how cryptographic hashes, signatures, and key material are represented, encoded, and bound to the metadata roles.
+* **Threat Mitigation Definitions:** Explicit descriptions of the specific software update threat models the framework addresses, serving as the basis for the protocol's security properties.
+
+## 3. Out of Scope
+To prevent unintentional intellectual property encumbrance, the following areas are explicitly excluded from the Working Group's scope:
+
+* **Payload Semantics:** The definition, structure, execution, or content of the target files distributed by the framework (e.g., binaries, containers, source code, or other supply chain metadata).
+* **Transport Protocols:** The definition or standardization of network transport layers or delivery mechanisms (e.g., HTTP, gRPC, IPFS) used to transmit metadata or targets.
+* **Cryptographic Primitives:** The invention, modification, or primary standardization of underlying cryptographic algorithms (e.g., Ed25519, SHA-256). The specification relies entirely on existing cryptographic standards.
+* **Server-Side Architecture:** The design, implementation, and operational architecture of backend repository servers, metadata generation tools, or key management infrastructure at the implementation level. The specification governs the artifacts produced by the server and consumed by clients at an algorithmic level and does not mandate an exact means of producing the information.
+* 
+Any changes of Scope are not retroactive.

governance/02-scope.md

@@ -0,0 +1,55 @@
+# Notices
+
+## Code of Conduct
+
+The Update Framework (TUF) is a [Cloud Native Computing Foundation](https://www.cncf.io/) project and follows the [TUF Community Code of Conduct](https://github.com/theupdateframework/community/blob/main/CODE-OF-CONDUCT.md), which follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).
+
+## License Acceptance
+
+Per Community Specification License 1.0 Section 2.1.3.3, Licensees may indicate their acceptance of the Community Specification License by issuing a pull request to the Specification's repository's Notice.md file, including the Licensee's name, authorized individuals' names, and repository system identifier (e.g. GitHub ID), and specification version.
+
+A Licensee may consent to accepting the current Community Specification License version or any future version of the Community Specification License by indicating "or later" after their specification version.
+
+---------------------------------------------------------------------------------
+
+Licensee's name:
+
+Authorized individual and system identifier:
+
+Specification version:
+
+---------------------------------------------------------------------------------
+
+## Withdrawals
+
+Name of party withdrawing:
+
+Date of withdrawal:
+
+---------------------------------------------------------------------------------
+
+## Exclusions
+
+This section includes any Exclusion Notices made against a Draft Deliverable or Approved Deliverable as set forth in the Community Specification Development License. Each Exclusion Notice must include the following information:
+
+-	Name of party making the Exclusion Notice:
+
+-	Name of patent owner:
+
+-	Specification:
+
+-	Version number:
+
+**For issued patents and published patent applications:**
+
+	(i)	patent number(s) or title and application number(s), as the case may be:
+
+	(ii)	identification of the specific part(s) of the Specification whose implementation makes the excluded claim a Necessary Claim.
+
+**For unpublished patent applications must provide either:**
+
+	(i) the text of the filed application; or
+
+	(ii) identification of the specific part(s) of the Specification whose implementation makes the excluded claim a Necessary Claim.
+
+-----------------------------------------------------------------------------------------

governance/03-notices.md

@@ -0,0 +1,11 @@
+# Licenses
+
+## Specification License
+
+Specifications in this repository are subject to the **Community Specification License 1.0** available at [https://github.com/CommunitySpecification/1.0](https://github.com/CommunitySpecification/1.0).
+
+## Source Code License
+
+If source code is included in this repository, or for sample or reference code included in the specification itself, that code is subject to the Apache-2.0 license unless otherwise marked.
+
+In the case of any conflict or confusion within this specification repository between the Community Specification License and the designated source code license, the terms of the Community Specification License shall apply.