Design repository library

[lukpueh]

[Update 2/14/22]

• ADR 10 shows the updated direction of this issue including further reading (design document, prototype implementation)
• Comments in thread here below point to survey documents for existing repository tooling, based on which ADR 10 was developed

---

[Original issue description]

Identify what functionality from existing repository_tool/repository_lib/roledb/keydb modules should exist in a TUF repository library on top of a metadata model as sketched in #1112.

Start with API functionality.

Coordinate with #1134.

[joshuagl]

I think a good place to start with this would be looking at what scaffolding Warehouse ends up building on top of the metadata API.

pypi/warehouse#7488
pypi/warehouse#8955

[joshuagl]

See also a WIP addition to the specification describes the repository workflow for adding/updating targets which this library should implement: theupdateframework/specification#153

[joshuagl]

See also a WIP addition to the specification describes the repository workflow for adding/updating targets which this library should implement: theupdateframework/specification#153

This has landed and can be referenced here https://theupdateframework.github.io/specification/latest/#adding-updating-targets

[jku]

Linking to #1459 (comment). If this issue is top-down design that one is definitely bottom-up: I'm creating initial repositories in a few places and the code always looks quite ugly but the last comment maybe has a decent idea that would work without lots of new API.

[lukpueh]

Adding the list of surveys of existing TUF repository implementations here so that we can close #1612...

• python-tuf
• repository-editor-for-tuf
• go-tuf and php-tuf
• AWS Tough
• Warehouse