Elgato_dark/python-tuf
1
0
Fork 0
mirror of https://github.com/theupdateframework/python-tuf synced 2026-05-24 10:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

client: new root sigs only counted once per keyid

Browse source 
When verifying newly downloaded root metadata with the keys listed in the
root metadata being verified, multiple signatures with the same keyid
should not be counted towards the threshold. A keyid should only count
once towards the threshold.

This fixes the _verify_root_self_signed() method introduced in PR #1101 to
ensure that keyids are only counted once when verifying a threshold of new
root signatures.

Signed-off-by: Joshua Lock <jlock@vmware.com>
This commit is contained in:
Joshua Lock 2020-11-23 16:13:51 +00:00
parent 71cb00478e
commit 83ac7be525
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
tuf/client/updater.py
View file

@ -1385,7 +1385,7 @@ def _verify_root_self_signed(self, signable):
signatures = signable['signatures']
signed = securesystemslib.formats.encode_canonical(
signable['signed']).encode('utf-8')
validated = 0
verified_sig_keyids = set()
for signature in signatures:
keyid = signature['keyid']
@ -1403,9 +1403,9 @@ def _verify_root_self_signed(self, signable):
valid_sig = securesystemslib.keys.verify_signature(key, signature, signed)
if valid_sig:
validated = validated + 1
verified_sig_keyids.add(keyid)
if validated >= threshold:
if len(verified_sig_keyids) >= threshold:
return True
return False