repository_tool vs developer_tool: refactoring needed

[awwad]

TUF provides interfaces for the update-providing side: repository_tool and developer_tool, and interfaces for the update-client side: updater (and now client...).

On the update-providing side, repository_tool and developer_tool have a lot of code achieving the same or similar things distinctly. These are in need of refactoring, as the disparities make the whole difficult to read and keep in mind, and they sit in a reference implementation. (Note that, historically, part of the reason for the redundant code is that they were originally intended as two separate stand-alone clients.)

Now, I think, the missions for these two modules should be to provide a simple, flexible, and thin interface to a set of code that provides the majority of the common functionality -- preferably in repository_lib, but alternatively in some new module if that proves more appropriate.

• developer_tool is meant to allow developers an interface to update/sign their artifacts and provide whatever is needed to a repository maintainer
• repository_tool is meant to allow repository maintainers to manage the repository, including updates to top-level roles and integration of delegated roles.

[jku]

Closing this issue as it was filed against (what is now known as) the legacy codebase: issue seems to not be relevant anymore. Please re-open or file a new issue if you feel that the issue is revelant to current python-tuf.

We do not have replacements for the tools yet (and likely will never have direct replacements) so this issue is not useful. There are plans for new repository components: see e.g. https://github.com/theupdateframework/python-tuf/blob/develop/docs/repository-library-design.md

More details

Current source code (and upcoming 1.0 release) only contains the modern components

• a low-level Metadata API (tuf.api) and
• tuf.ngclient that implements the client workflow,

Legacy components (e.g. tuf.client, tuf.repository_tool, tuf.repository_lib as well as the repo and client scripts) are no longer included. See announcement and API reference for more details.