tuf: review the cache / local storage directory names

[jku]

I noticed that during the refactoring of #351 the directories changed from:

<USER_CACHE_DIR>/sigstore-python/tuf/<QUOTED_REPO_URL>
<USER_DATA_DIR>/sigstore-python/tuf/<QUOTED_REPO_URL>

to

<USER_CACHE_DIR>/sigstore-python/<QUOTED_REPO_URL>
<USER_DATA_DIR>/sigstore-python/<QUOTED_REPO_URL>

this is going to work fine until sigstore-python wants to cache or store other application data... should we re-add that "tuf" component in there now or only solve that problem when it becomes an issue?

[woodruffw]

Hmm -- I changed that as part of the appdirs refactor, although I can't remember exactly why.

I'm probably missing it, but I don't see how the current scheme poses a challenge for other caching. If we were to e.g. add an HTTP cache, I'd expect the structure to be:

$CACHE/sigstore-python/
    quoted-tuf-repo-1/
    quoted-tuf-repo-2/
    http/

[jku]

Sure, conflicts would be exceptional, it's not something I would expect to happen without some ill intent... but if in the future custom sigstore instances involve a custom TUF repository, then the repository URLs (and thus directory names) in the client likely become user controlled to some extent.

It doesn't look a like a big deal but it smells just slightly wrong :)

[woodruffw]

I see your point! I agree then -- let's revert back to the previous cache layout. No need for any ambiguity where none is necessary 🙂