Skip to content

Update wildcard pattern behavior #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adityasaky wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Update wildcard pattern behavior #301

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
5b6279e
Update wildcard pattern behavior
adityasaky Feb 23, 2024
461cfb6
fixup! remind why this is important
adityasaky Feb 23, 2024
4ed28cf
fixup! version bump
adityasaky Feb 23, 2024
16b84b1
Merge branch 'master' into add-pattern-warnings
joshuagl Aug 5, 2026
eae85c6
Apply suggestions from code review
joshuagl Aug 5, 2026
a7fd3d2
Update tuf-spec.md
joshuagl Aug 5, 2026
40a522e
Merge branch 'master' into add-pattern-warnings
joshuagl Aug 10, 2026
6fa8c75
Merge branch 'master' into add-pattern-warnings
joshuagl Oct 16, 2026
3e6d2af
Update date and version
joshuagl Oct 16, 2026
6550c34
Merge branch 'master' into add-pattern-warnings
joshuagl Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions tuf-spec.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ Title: The Update Framework Specification
Shortname: TUF
Status: LS
Abstract: A framework for securing software update systems.
Date: 2026-10-08
Date: 2026-10-16
Editor: Justin Cappos, NYU
Editor: Trishank Karthik Kuppusamy, Apple
Editor: Joshua Lock, University of Lincoln
Expand All @@ -16,7 +16,7 @@ Boilerplate: copyright no, conformance no
Local Boilerplate: header yes
Markup Shorthands: css no, markdown yes
Metadata Include: This version off, Abstract off
Text Macro: VERSION 1.0.37
Text Macro: VERSION 1.0.38
</pre>

Note: We strive to make the specification easy to implement, so if you come
Expand Down Expand Up @@ -1086,15 +1086,27 @@ attributes are OPTIONAL, if used, exactly one of them should be set.
also recommended for <a>TARGETPATH</a>. A path separator in a path SHOULD
NOT be matched by a wildcard in the <a>PATHPATTERN</a>.

Note: As each <a>PATHPATTERN</a> describes the paths that a delegated role is
trusted to provide, it is important to understand the functioning of path
patterns to avoid mistaken assumptions that can lead to a false sense of
security. For example, an assumption that `"foo/*"` applies recursively to
all files in subdirectories of `foo` in a terminating delegation could allow
a subsequent delegated role that should not be trusted to sign for a target
in a subdirectory of `foo`.

Some example <a>PATHPATTERN</a>s and expected matches:
* a <a>PATHPATTERN</a> of `"targets/*.tgz"` would match file paths
`"targets/foo.tgz"` and `"targets/bar.tgz"`, but not `"targets/foo.txt"`.
* a <a>PATHPATTERN</a> of `"foo-version-?.tgz"` matches
`"foo-version-2.tgz"` and `"foo-version-a.tgz"`, but not
`"foo-version-alpha.tgz"`.
* a <a>PATHPATTERN</a> of `"*.tgz"` would match `"foo.tgz"` and `"bar.tgz"`,
but not `"targets/foo.tgz"`
* a <a>PATHPATTERN</a> of `"foo.tgz"` would match only `"foo.tgz"`
but not `"targets/foo.tgz"`.
* a <a>PATHPATTERN</a> of `"foo.tgz"` would match only `"foo.tgz"`.
* a <a>PATHPATTERN</a> of `"foo/*"` matches `"foo/bar.tgz"` but not
`"foo/baz/bar.tgz"`, `"foo/bar/baz/bar.tgz"`, and so on.




Prioritized delegations allow clients to resolve conflicts between delegated
Expand Down
Loading