Web Resource Distribution Acquisition Status
Web Resource Distribution Acquisition Status
Issue: #1855
This note records the induction status for sources requested by the web-backed AIWG resource distribution epic.
Inducted in Public AIWG References
| Public REF | Source | GRADE | Acquisition status |
|---|---|---|---|
| REF-067 | Semantic Versioning 2.0.0 | A | Official web specification reviewed |
| REF-068 | npm dist-tags and package lockfile integrity | A- | Official npm/registry documentation reviewed |
| REF-069 | OCI Distribution Specification | A | Official OCI repository and rendered spec reviewed |
| REF-070 | OCI Image Specification | A | Official OCI repository and descriptor spec reviewed |
| REF-071 | W3C Subresource Integrity | A | W3C SRI specification reviewed |
| REF-072 | The Update Framework Specification | A | Official TUF specification and publication list reviewed |
| REF-073 | Cryptographic Registry Provenance | B | Local research REF-1814 full text/PDF archived |
| REF-074 | Signing Is Not Enough | B | Local research REF-742 web snapshot archived |
| REF-075 | Supply-Chain Poisoning Against Agent Skills | A- | Local research REF-936 full text/PDF archived |
Pending Acquisition
These are named by the TUF publication list but were not already available as public AIWG REF entries or as local source files in this checkout:
- Survivable Key Compromise in Software Update Systems
- Diplomat: Using Delegations to Protect Community Repositories
- *Mercury: Bandwidth-Effective Prevention of Rollback Attacks Against
Community Repositories*
- A Look In the Mirror: Attacks on Package Managers
They should be acquired through the research corpus workflow before AIWG adds paper-specific claims beyond the high-level TUF summary in REF-072.
ADR Cross-Link Status
The issue body names `.aiwg/architecture/` ADR files, but this checkout's public `.aiwg` artifact tree does not include that architecture directory. The available public operator contract, `docs/install/web-backed-resources.md`, now links the final public REF entries under its Research Basis section.