Conversation
|
@vkhoroz @mike-scott - You may want to look at this. |
Signed-off-by: Andy Doan <doanac@qti.qualcomm.com>
| Loss of this key and/or the HMAC key will make it impossible to sign new | ||
| Updates after the key **expires**. | ||
|
|
||
| The root role is valid for 20 years (root.json's `signed.expires` attribute). |
There was a problem hiding this comment.
I'd place this at the top of this section.
As is, it breaks up two paragraphs talking about how important a root key is.
There was a problem hiding this comment.
I'm trying to figure out the best wording here. e.g. I don't want to put too many words in front of "you must never lose" or the user will skip right past the most important text of the section.
@kprosise - let me know what you think works best here and I'll apply it for all the sections.
There was a problem hiding this comment.
Well for line 19, I think placing it as the last line in the subsection would be best. As for the "you must never lose" bit, perhaps placing it in a warning callout (> [!WARNING]) would work? I know it precedes a note callout, but I think it would be okay to have two callouts together.
vkhoroz
left a comment
vkhoroz
left a comment
There was a problem hiding this comment.
LGTM
I think this is fine to go after we work through a couple of points and Katrina gives it a read.
kprosise
left a comment
kprosise
left a comment
There was a problem hiding this comment.
Left some suggestions and a recommendation, but overall it looks good.
| Loss of this key and/or the HMAC key will make it impossible to sign new | ||
| Updates after the key **expires**. | ||
|
|
||
| The root role is valid for 20 years (root.json's `signed.expires` attribute). |
There was a problem hiding this comment.
Well for line 19, I think placing it as the last line in the subsection would be best. As for the "you must never lose" bit, perhaps placing it in a warning callout (> [!WARNING]) would work? I know it precedes a note callout, but I think it would be okay to have two callouts together.
| The update server uses a single Timestamp key under `<datadir>/tuf/keys/timestamp.key`. | ||
| It is encrypted on disk with an HMAC key. This is considered an "online" key | ||
| and must be present for the update server to perform normal operations. This | ||
| key can be regenerated and is valid for 20 years. |
There was a problem hiding this comment.
"It is encrypted on disk with an HMAC key. This is considered an "online" key
and must be present for the update server to perform normal operations. This
key can be regenerated and is valid for 20 years."
Given how this bit repeats for each role, and the only thing that changes is the key name, Would it be appropriate to "factor it out" and place it at the top of the page in a generic form?
There was a problem hiding this comment.
I tried to clean this up with commit a5316de - let me know what you think; i'm not super happy with my wording
Signed-off-by: Andy Doan <doanac@qti.qualcomm.com>
3 participants
No description provided.