Uh oh!
There was an error while loading. Please reload this page.
Update TUF threshold information and editor details - #314
Merged
Conversation
I'm proposing a patch spec update to make it clearer that a threshold of 0 (or less) is not allowed. See: GHSA-fphv-w9fq-2525 for more details. I've also updated people's affiliation and suggested that slack is the best way to contact us. Signed-off-by: Justin Cappos <justincappos@gmail.com>
mnm678
previously approved these changes
Jan 19, 2026
lukpueh
previously approved these changes
Jan 20, 2026
lukpueh
left a comment
Member
There was a problem hiding this comment.
Thanks for the change. Apart from Joshua's affiliation this looks good!
Uh oh!
There was an error while loading. Please reload this page.
Co-authored-by: Lukas Pühringer <luk.puehringer@gmail.com> Signed-off-by: Justin Cappos <justincappos@gmail.com>
JustinCappos
commented
Jan 20, 2026
MemberAuthor
Sounds good! I applied your fix. Please approve and I'll merge |
mnm678
previously approved these changes
Jan 20, 2026
joshuagl
previously approved these changes
Jan 22, 2026
lukpueh
previously approved these changes
Jan 22, 2026
Signed-off-by: Justin Cappos <justincappos@gmail.com>
JustinCappos
dismissed stale reviews from lukpueh, joshuagl, and mnm678
via
January 22, 2026 20:10
d8ff088Signed-off-by: Justin Cappos <justincappos@gmail.com>
mnm678
approved these changes
Jan 22, 2026
Uh oh!
There was an error while loading. Please reload this page.
joshuagl added a commit
to joshuagl/specification
that referenced
this pull request
Aug 5, 2026
theupdateframeworkGH-314 introduced a second definition of THRESHOLD _without_ a <dfn> tag. There are two ways we can fix this: 1. introduce a second dfn tag and use a for attribute on each definition, i.e., <dfn for="root"> 2. streamline to a single definition and update the DELEGATIONS definition to reference the THRESHOLD definition in the root section I've opted for 2 here as it's simpler and avoids redundant duplicate definitions. Signed-off-by: Joshua Lock <joshuagloe@gmail.com>
mnm678 pushed a commit
that referenced
this pull request
Aug 10, 2026
* Only define THRESHOLD once GH-314 introduced a second definition of THRESHOLD _without_ a <dfn> tag. There are two ways we can fix this: 1. introduce a second dfn tag and use a for attribute on each definition, i.e., <dfn for="root"> 2. streamline to a single definition and update the DELEGATIONS definition to reference the THRESHOLD definition in the root section I've opted for 2 here as it's simpler and avoids redundant duplicate definitions. Signed-off-by: Joshua Lock <joshuagloe@gmail.com> * Fix warnings from latest bikeshed We have two definitions of KEYID and, by default, we get a random one at build time if the `for` attribute is not specified on the anchor (<a>) element. Squash randomness by always referring to the KEYID definition for the root role. Signed-off-by: Joshua Lock <joshuagloe@gmail.com> * Pin the bikeshed version we use in workflows This will prevent bikeshed releases unintentionally breaking our builds without anyone noticing until a CI workflow with additional changes is run. Signed-off-by: Joshua Lock <joshuagloe@gmail.com> * Update Joshua's affiliation Changed role, updating affiliation Signed-off-by: Joshua Lock <joshuagloe@gmail.com> * Bump Version and Date for this PR Signed-off-by: Joshua Lock <joshuagloe@gmail.com> --------- Signed-off-by: Joshua Lock <joshuagloe@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I'm proposing a patch spec update to make it clearer that a threshold of 0 (or less) is not allowed. See: GHSA-fphv-w9fq-2525 for more details.
I've also updated people's affiliation and suggested that slack is the best way to contact us.