theupdateframework / go-tuf

Go implementation of The Update Framework (TUF)
https://theupdateframework.com
Apache License 2.0
625 stars 105 forks source link

fix!: spec version field to follow semver #512

Closed rdimitrov closed 8 months ago

rdimitrov commented 1 year ago

The following PR updates the initial spec_version values for all metadata roles so they comply with the specification by following the SemVer format.

Note that if there's an implementation that depends on a non-spec compliant versioning it may be affected by this change, so thus why it is marked as breaking.

Related #206

Release Notes:

Types of changes:

Description of the changes being introduced by the pull request:

Please verify and check that the pull request fulfills the following requirements:

rdimitrov commented 1 year ago

Would this break new clients on old metadata? Could/should we make it tolerant of the exact string "1.0"?

From what I've seen I haven't found a place where go-tuf actually takes into account the format of the spec_version value, so thus why I think it shouldn't break any new or existing go-tuf clients.

Nevertheless, I've marked it as breaking due to the fact that there might be some other client implementation (go or something else) that actually takes into account this format.

rdimitrov commented 8 months ago

Closing this one since the code base change and is no longer relevant