notaryproject / tuf

The Update Framework for OCI Registries
11 stars 11 forks source link

Signing multiple versions #4

Open mnm678 opened 2 years ago

mnm678 commented 2 years ago

What does it mean for artifacts to be current? Unlike in many package managers, a new version does not necessarily replace the old version, so TUF needs to account for multiple valid versions of an artifact. Users can include all historical versions in their targets metadata, but this can get out of control for projects with thousands of previous releases, so we also want to encourage users to remove images from targets metadata at some point.

This issue is part of #2.