Discussion of TAP 13: User Selection of the Top-Level Target Files Through Mapping Metadata about taps

[joshuagl]

Some thoughts on these questions:

• repository vs client hosted alternate top-level targets metadata I like the suggestion to allow a client to provide a mapping to a local top-level targets metadata – is that a new, follow-on, TAP or something we should figure out in the scope of this TAP?
• client mapping format Looking at the client mapping format used in the PoC I'd like to suggest "targets_filename" -> "targets_rolename" as we want to move away from being file-centric in the spec. Otherwise, that mapping format seems like a reasonable starting point.
• metadata on multiple repositories I suppose the naive approach here is that a TAP13 mapping lists trusted keys for a targets role (top-level or delegated) and that any targets metadata in a TAP4 targets mapping would need to be able to be verified with a threshold of the TAP13 provided keys for the targets role. I don't think there's a security issue here? Maybe some threshold counting gnarliness if keys are being reused?