Implementations compatibility

16 views
Skip to first unread message

Cirujano Cuesta, Silvano

unread,
Mar 13, 2020, 12:36:59 PM3/13/20
to theupdate...@googlegroups.com
Is there any table or similar showing compatibility between the different TUF implementations and the specification versions? If I got it right, some implementations are not 100% specification conform. E.g. Notary not being compatible with the latest specification.

Use-case: use the Python implementation to maintain the repository and a different information on the target devices.

Thanks,
Silvano

Cirujano Cuesta, Silvano

unread,
Mar 18, 2020, 6:23:39 PM3/18/20
to theupdate...@googlegroups.com
Go-TUF [1] was even testing compatibility with the Python reference implementation [2], but that
project doesn't really appear to be alive [3] :-(

Silvano

[1] https://github.com/flynn/go-tuf
[2] https://github.com/flynn/go-tuf/blob/master/client/testdata/README.md#tuf-testdata
[3] https://github.com/flynn/go-tuf/commits/master

Jonathan Rudenberg

unread,
Mar 18, 2020, 6:32:56 PM3/18/20
to theupdate...@googlegroups.com
Hi Silvano,

I'm a maintainer of go-tuf. We were compatible with the python version a few years ago when we shipped it, but there are no known bugs and we haven't had spare cycles to update it for the spec changes recently. We do have bandwidth to review PRs though, and the Fuchsia team did do some work to update it[1], so if you or anyone else wants to help backport the changes and update everything we'd be happy to review/merge.

Cheers,

Jonathan

[1] https://fuchsia.googlesource.com/third_party/go-tuf/
> --
> You received this message because you are subscribed to the Google
> Groups "The Update Framework (TUF)" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to theupdateframew...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/theupdateframework/1f1482e9d94dbdcf71fe7ebfb7f210eed40b4ec1.camel%40siemens.com.
>

Jonathan Rudenberg

unread,
Mar 18, 2020, 6:35:15 PM3/18/20
to theupdate...@googlegroups.com

Erick Tryzelaar

unread,
Mar 18, 2020, 6:42:16 PM3/18/20
to Jonathan Rudenberg, The Update Framework (TUF)
Hello!

I'm maintaining the Fuchsia go-tuf [1] fork and rust-tuf [2]. I got a preliminary interoperability test suite in [3] and [4] in order to verify our host-side repositories (written with go-tuf) can interact with our target-side clients (written with rust-tuf). The test I implemented verifies that the clients can walk through all key rotations. Some day I'd love to extend it further, and eventually extract these out into their own repo. That way it'd be easy for others to add new tests, and other libraries verify they can work with each other. I just haven't had time yet to implement it (likewise, I'm sorry Jonathan I still haven't uploaded my go-tuf patches either!). If anyone is interested in doing this, I'd be happy to help out.

Thanks,
Erick

Trishank Kuppusamy

unread,
Mar 19, 2020, 11:34:34 AM3/19/20
to The Update Framework (TUF)
Thanks for your replies, Jonathan and Erick!

While I have everyone here, please join us at the [CNCF Slack channel](https://app.slack.com/client/T08PSQ7BQ/C8NMD3QJ3), where we can interactively continue these discussions. Happy to email invites to anyone interested.
Reply all
Reply to author
Forward
0 new messages