Christopher Gervais

Certainly. The principal difference is whether you want derivatives to remain free also.

I _think_ the issue might be stemming from [here](http://www.drupalcontrib.org/api/drupal/contributions%21feeds%21plugins%21FeedsParser.inc/function/FeedsEnclosure%3A%3AgetFile/7), where Feeds appears indeed not to call `file_stream_wrapper_uri_normalize()`. Bear with me, as I'm not very familiar with this code... Seeing as...

Calling `file_stream_wrapper_uri_normalize()` on `$destination` doesn't appear to do anything... is the bucket name supposed to be injected at some point?

I'm also running Ubuntu 20.04. While the Redis backend works, switching to the AMQP backend fails to return any results from tasks. FWIW, I can see that the tasks succeed...

> Can you remove the changes to tap1? If they need to be part of a PR, they can be a separate one. Yes, of course. I was separately experimenting...

> You mention TOFU but it's a little unclear how the client reacts when top level repository changes the "initial sub-repo metadata". > Assume client has cached earlier sub-repo metadata...

> - if the signers are project maintainers (or project-specific release automation), then signing keys will be lost and some maintainers will turn out to be malicious: In a high-volume...

> Compare to a setup where there are no sub-repos and the top-level TUF repo only contains a set of public keys as artifacts (no project indexes or packages are...

> the one clear advantage TAP-21 seems to have is builtin timeliness check from timestamp role [...] This is an advantage of TUF, not TAP-21 specifically. TUF also affords protection...

> Left some comments in your TAP PR, @ergonlogic. I think your real problem there is different than the one you have proposed a solution for. Thank you, I've responded...