From 19b573a6f771ca074b6329ccc9ad323169af112e Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Fri, 20 Aug 2021 12:11:45 +0100 Subject: [PATCH] Change should to must in v2 spec We found some examples of manifests with URLs specififed that did not provide a digest or size. This breaks the security model by allowing the content to change, as it no longer provides a Merkle tree. This was not intended, so explicitly disallow by tightening wording. Signed-off-by: Justin Cormack (cherry picked from commit 1660df4b605cab74deaf851e43de9df104aaa0cd) Signed-off-by: Sebastiaan van Stijn --- docs/spec/manifest-v2-2.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/spec/manifest-v2-2.md b/docs/spec/manifest-v2-2.md index 3d646a70..8ff2cadf 100644 --- a/docs/spec/manifest-v2-2.md +++ b/docs/spec/manifest-v2-2.md @@ -220,7 +220,7 @@ image. It's the direct replacement for the schema-1 manifest. - **`urls`** *array* Provides a list of URLs from which the content may be fetched. Content - should be verified against the `digest` and `size`. This field is + must be verified against the `digest` and `size`. This field is optional and uncommon. ## Example Image Manifest