Implementations compatibility

[Cirujano Cuesta, Silvano]

Is there any table or similar showing compatibility between the different TUF implementations and the specification versions? If I got it right, some implementations are not 100% specification conform. E.g. Notary not being compatible with the latest specification.

Use-case: use the Python implementation to maintain the repository and a different information on the target devices.

Thanks,
Silvano

[Cirujano Cuesta, Silvano]

Go-TUF [1] was even testing compatibility with the Python reference implementation [2], but that
project doesn't really appear to be alive [3] :-(

Silvano

[1] https://github.com/flynn/go-tuf
[2] https://github.com/flynn/go-tuf/blob/master/client/testdata/README.md#tuf-testdata
[3] https://github.com/flynn/go-tuf/commits/master

[Jonathan Rudenberg]

Hi Silvano,

I'm a maintainer of go-tuf. We were compatible with the python version a few years ago when we shipped it, but there are no known bugs and we haven't had spare cycles to update it for the spec changes recently. We do have bandwidth to review PRs though, and the Fuchsia team did do some work to update it[1], so if you or anyone else wants to help backport the changes and update everything we'd be happy to review/merge.

Cheers,

Jonathan

[1] https://fuchsia.googlesource.com/third_party/go-tuf/

> --
> You received this message because you are subscribed to the Google
> Groups "The Update Framework (TUF)" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to theupdateframew...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/theupdateframework/1f1482e9d94dbdcf71fe7ebfb7f210eed40b4ec1.camel%40siemens.com.
>

[Jonathan Rudenberg]

BTW, there are some details here as well: https://github.com/flynn/go-tuf/issues/105#issuecomment-370768146

> https://groups.google.com/d/msgid/theupdateframework/49b5286d-1e28-4ee3-b9d6-c56c7317501f%40www.fastmail.com.
>

[Erick Tryzelaar]

Hello!

I'm maintaining the Fuchsia go-tuf [1] fork and rust-tuf [2]. I got a preliminary interoperability test suite in [3] and [4] in order to verify our host-side repositories (written with go-tuf) can interact with our target-side clients (written with rust-tuf). The test I implemented verifies that the clients can walk through all key rotations. Some day I'd love to extend it further, and eventually extract these out into their own repo. That way it'd be easy for others to add new tests, and other libraries verify they can work with each other. I just haven't had time yet to implement it (likewise, I'm sorry Jonathan I still haven't uploaded my go-tuf patches either!). If anyone is interested in doing this, I'd be happy to help out.

Thanks,

Erick

[1]: https://fuchsia.googlesource.com/third_party/go-tuf/

[2]: https://github.com/heartsucker/rust-tuf

[3]: https://fuchsia.googlesource.com/third_party/go-tuf/+/refs/heads/master/client/testdata/

[4]: https://github.com/heartsucker/rust-tuf/tree/develop/tests/interop

To view this discussion on the web visit https://groups.google.com/d/msgid/theupdateframework/49b5286d-1e28-4ee3-b9d6-c56c7317501f%40www.fastmail.com.

[Trishank Kuppusamy]

Thanks for your replies, Jonathan and Erick!

While I have everyone here, please join us at the [CNCF Slack channel](https://app.slack.com/client/T08PSQ7BQ/C8NMD3QJ3), where we can interactively continue these discussions. Happy to email invites to anyone interested.