Skip to content

Update wildcard pattern behavior #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adityasaky wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Update wildcard pattern behavior #301

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5b6279e
Update wildcard pattern behavior
adityasaky Feb 23, 2024
461cfb6
fixup! remind why this is important
adityasaky Feb 23, 2024
4ed28cf
fixup! version bump
adityasaky Feb 23, 2024
16b84b1
Merge branch 'master' into add-pattern-warnings
joshuagl Aug 5, 2026
eae85c6
Apply suggestions from code review
joshuagl Aug 5, 2026
a7fd3d2
Update tuf-spec.md
joshuagl Aug 5, 2026
40a522e
Merge branch 'master' into add-pattern-warnings
joshuagl Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions tuf-spec.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ Title: The Update Framework Specification
Shortname: TUF
Status: LS
Abstract: A framework for securing software update systems.
Date: 2023-04-14
Date: 2024-02-23
Editor: Justin Cappos, NYU
Editor: Trishank Karthik Kuppusamy, Datadog
Editor: Joshua Lock, Verizon
Expand Down Expand Up @@ -1093,8 +1093,17 @@ attributes are OPTIONAL, if used, exactly one of them should be set.
`"foo-version-2.tgz"` and `"foo-version-a.tgz"`, but not
`"foo-version-alpha.tgz"`.
* a <a>PATHPATTERN</a> of `"*.tgz"` would match `"foo.tgz"` and `"bar.tgz"`,
but not `"targets/foo.tgz"`
* a <a>PATHPATTERN</a> of `"foo.tgz"` would match only `"foo.tgz"`
but not `"targets/foo.tgz"`.
* a <a>PATHPATTERN</a> of `"foo.tgz"` would match only `"foo.tgz"`.
* a <a>PATHPATTERN</a> of `"foo/*"` matches `"foo/bar.tgz"` but not
`"foo/baz/bar.tgz"`, `"foo/bar/baz/bar.tgz"`, and so on.

Note: It is important to understand the functioning of path patterns to

@trishankatdatadog trishankatdatadog Feb 23, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd also list a note to the opposite effect first: remind the reader why this behaviour is there (not for arbitrary reasons).

@adityasaky adityasaky Feb 23, 2024

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tweaked the text a bit, does it help?

@trishankatdatadog trishankatdatadog Feb 26, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, sorry. First, please briefly explain why the current patterns work the way they do, and as such, they are optimised for those anticipated use cases. Your use cases here are outside of that, and should thus fall under a second paragraph.

@adityasaky adityasaky Feb 26, 2024

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not the best person to discuss why the current patterns work the way they do as I don't actually have that context. @mnm678 can you help with some text here? Thanks!

avoid mistaken assumptions that can lead to a false sense of security. For
example, an assumption that `"foo/*"` applies recursively to all files in
subdirectories of `foo` in a terminating delegation could allow a subsequent
delegated role that should not be trusted to sign for a target.



Prioritized delegations allow clients to resolve conflicts between delegated
Expand Down