TAP editor elections / refresh

[JustinCappos]

Interested parties who would like to be a TAP editor please reply to this issue to nominate themselves (or others, assuming you have permission). Please mention your experience in the TUF ecosystem and why you'd like to help.

This is a very important role in the TUF ecosystem and is relatively low volume (reviewing ~2 TAPs a year).

[OmBiradar]

I would like to nominate myself 😄

Experience:

• Been a LFX mentee at RSTUF, did deep discussions on TUF framework and various TAPs to be introduced.
• I read the whole TAP documentation and all the TAPs upto last winter I guess.

Why I would like to help:

• I do not want my knowledge about TUF go to waste
• I would like to contribute to OSS continuously
• I love to spend time reading new stuff ideas

[kairoaraujo]

I would like to nominate myself

Experience:

• Maintainer of The Update Framework python library
• Author of Repository Service for TUF (RSTUF)
• I have spoken about TUF and RSTUF in few different conferences (Open Source Summit, KubeCon, etc)
• I've advocating for TUF adoption on content distribution

[Marc-cn]

I would like to nominate myself.

Experience:

• Postdoctoral associate at NYU's Secure Systems Lab, where TUF is one of the projects I'm part of and at the NYU Software Supply Chain Security Operations Center (NSOC)
• Specification and governance work on the TUF specification itself: I opened the Community Specification License compliance PR (theupdateframework/specification#317), coordinating with the Linux Foundation
• Contributor across adjacent supply chain tooling and specs: SBOMit, Witness

Why I'd like to help:

• I already read and work on this material and I'm glad to take on a share of the reviews

[cyphar]

I'd like to nominate myself as well.

Experience:

• Designed and implemented our own higher-level management system of TUF at @amutable-systems, which involved reviewing the specification and TAPs in great detail.
• Worked on systems like the OCI image specification (and wrote its reference implementation, umoci) which took inspiration from aspects of TUF.
• Found a few minor issues in TUF when doing the research for our usage in @amutable-systems.

Why I'd like to help:

• I followed TUF from way back when it got spun out from the Tor Project and when it was being integrated into the CNCF via Notary. I've always found it to be an interesting project and would love the opportunity to help improve it.
• We have a somewhat unconventional usecase for TUF so I hope that our insights can help make future TAPs more general-purpose.
• I'm a FOSS guy at heart and love to contribute back to projects I use!

[joshuagl]

Hi. I would like to nominate myself.

I've been quiet on the TUF front for the past couple of years, beyond approving a few low-stakes PRs, but I'm still interested and I think my recent change of employment should allow for reviewing ~2 TAPs a year.

[kipz]

I'd like to nominate myself as a TAP editor.

Experience

Around the community since late 2023, first at Docker and now at Datadog. Fairly regular on the community call, presented/demoed a couple of times, and have volunteered on TUF/CNCF booths at conferences.

Written:

• A draft TAP on ephemeral signing keys via OpenPubkey (Nov 2023) (not submitted).
• "TUF metadata in OCI Registries". Touches TAPs 11, 16 and 19.

Reviewed: TAP 8, where I raised the unbounded-rotation-chain DoS that became #183; the revocation TAP (#182); TAP 16 acceptance (#188).

Built tuf-spec-explorer to model all 20 TAPs and their interactions, because I kept losing track of how a new TAP would land against the existing set.

Also: Deployed TUF a few times, PRs to go-tuf and tuf-on-ci; go-tuf-mirror; a DockerCon 2023 talk;

Why I'd like to help

I use TUF, I've deployed it, and I've spent a bit of time worrying about how TAPs interact. Two reviews a year seems a reasonable way to put that to use.