Repository metadata is TUF-signed on the registry side (RFC §4.3), but the Moodle client doesn't yet verify signatures — it trusts HTTPS plus the per-artifact SHA-256 from metadata. Full client-side TUF closes the loop: a mirror (or compromised origin) couldn't serve altered metadata either, and timestamp expiry bounds staleness.
Scope: verify the TUF chain (root → targets) before trusting packages.json/advisories; ship pinned root of trust with the plugin; handle key rotation.
Repository metadata is TUF-signed on the registry side (RFC §4.3), but the Moodle client doesn't yet verify signatures — it trusts HTTPS plus the per-artifact SHA-256 from metadata. Full client-side TUF closes the loop: a mirror (or compromised origin) couldn't serve altered metadata either, and timestamp expiry bounds staleness.
Scope: verify the TUF chain (root → targets) before trusting
packages.json/advisories; ship pinned root of trust with the plugin; handle key rotation.