Re: [Suit] Update to multiple trust domains

[Dave Thaler <[e-mail]>]

TEEP is still waiting for a resolution to issue Uninstalling trusted components · Issue #238 · ietf-teep/teep-protocol (github.com)<https://github.com/ietf-teep/teep-protocol/issues/238> which is:

As discussed on the list (and presented in the IETF 114 meeting)... this issue tracks the impact on the TEEP spec
Ken Takayama writes:
Proposal
Add suit-uninstall to the Multiple Trust Domains document because it
is useful functionality when updating depending components in some situations.
...
Issue
The library-a is no more required and should be uninstalled, but how
to uninstall it when updating the application?
>From a TEEP perspective, I think this is important to say how to do. I run into this issue in my TEEP implementation too.
The TEEP protocol used to have a field in the Update message (in addition to any SUIT manifests) that identified which components to remove. Recently the TEEP protocol was updated to just list manifests, under an assumption that the manifest would contain deletion instructions.
The TAM (an update server) sends manifests or references to them, to a TEEP Agent (a device on which to install/update/uninstall components with SUIT manifests).
So to do a deletion, the TAM needs a way to indicate that without it being the component author. It could do that by the TAM creating the SUIT manifests themselves, and incrementing the sequence number to do a deletion but that would require generating manifests on the fly rather than having one manifest for all TEEP Agents, some of which might have the component installed and some not.
It could also do it by not using a newer SUIT manifest but having the uninstall directives included in the installation manifest as Ken proposed, in which case the original TEEP mechanism might make sense to put back in.

Personally (as a TEEP implementer), I would prefer having the uninstall directives included in the installation manifest as Ken originally proposed.

Let me know if this has been addressed in some SUIT document already.

Thanks!
Dave

From: Suit <[e-mail]> On Behalf Of Brendan Moran
Sent: Friday, October 14, 2022 6:59 AM
To: suit <[e-mail]>
Subject: [Suit] Update to multiple trust domains

I have uploaded a PR for some changes to the multiple trust domains draft, inline with the recommendations that Øyvind made for handling dependencies. Please let me know if you have any feedback!

https://github.com/bremoran/suit-multiple-trust-domains/pull/2<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbremoran%2Fsuit-multiple-trust-domains%2Fpull%2F2&data=05%7C01%7Cdthaler%40microsoft.com%7C52b0e1cc52dd4a869fee08daadec39fd%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638013527966443470%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=JxcgEZU29ebs0uxAHU2jsYkb%2FAUfiJxQR%2BY%2B3bsfSBE%3D&reserved=0>

Best Regards,
Brendan