diff --git a/ITE/2/README.adoc b/ITE/2/README.adoc index 6809062..62799dc 100644 --- a/ITE/2/README.adoc +++ b/ITE/2/README.adoc @@ -176,9 +176,13 @@ from that for another package. This MAY be done in a number of different ways, but perhaps the simplest is to use directories with unique names to isolate different in-toto link metadata for different packages, where the name MAY be the SHA-256 hash of the "`developer`" step link metadata file -for a particular package. The root layout MAY be identical for each -of these packages, but it can differ to allow for changes in the supply -chain such as changes in functionaries' keys. +for a particular package. The root layouts MAY be identical for each +of these packages where they are all the results of the same supply chain. +The root layouts MAY differ to allow for changes in the supply chain (such +as revoking functionaries' keys), or even to account for packages that are +from entirely different supply chains (therefore, with entirely different +root layouts). By using consistent snapshots and defining custom targets +metadata, backward compatibility can be maintained. . The targets metadata MUST also list the targets metadata of all in-toto link metadata files associated with all available packages. Note that as the number of packages grows, so will the size of this metadata