Feature: Create/Remove custom delegate Target Roles

[kairoaraujo]

What is the feature about?

The user could have the flexibility to create delegated roles from the Targets Role.

The delegated role would require:

• Role name (not allowed top-level roles and BINS)
• path to make it unique, for example project-name/*/*
  • the top-level * is reserved for current RSTUF BINS succinct delegate role
• Optional succinct delegated roles and the size
  • The name would be automatically the Role name followed by -bins. For example: MyProjectRole will create also MyProjectRole-bins
  • It will automatically use the online key

This feature requires the following features as pre-requisite:

• Feature: Metadata Update (Key Rotation) #23
• Feature: support distributed async threshold signing  #327

Services it relates to

repository-service-for-tuf-api, repository-service-for-tuf-worker

Related tasks

No response

References

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[MVrachev]

Last week we had a couple of meetings with RSTUF contributors where we discussed some general notes about this feature:

1. We will support only path prefixes. The other option - path hash prefixes is not considered for now.
2. All Custom Target Roles will use the same 1 online key as the rest of the online roles
   a. Add documentation that custom target roles doesn’t support custom keys at the moment. - ISSUE
3. We are conservative: only artifacts with paths matching one of the prefixes of custom target roles are allowed
4. If the user wants to add an artifact with path not included in any path prefixes we say we cannot do this.
5. We need to validate that input of the custom target role paths contains specific characters (letters and numbers for example) DO NOT ALLOW: *, /, \, ., etc. as those can lead to unexpected results.

[MVrachev]

TODO first iteration defining custom target roles only during initial bootstrap:

• Task: add support for custom delegated Target roles at POST /api/v1/bootstrap repository-service-tuf-api#517
• Task: add support for custom delegated Target roles repository-service-tuf-worker#438
• Task: add support for custom Target roles delegations repository-service-tuf-cli#491