Elgato_dark/python-tuf
1
0
Fork 0
mirror of https://github.com/theupdateframework/python-tuf synced 2026-05-24 10:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add comment to affected modules...

Browse source 
explaining why locally generated keyids use the hashing algorithms specified in metadata's 'keyid_hash_algorithms' field.

Signed-off-by: Vladimir Diaz <vladimir.v.diaz@gmail.com>
This commit is contained in:
Vladimir Diaz 2018-04-12 11:43:03 -04:00
parent 55d368d9d4
commit 903ff0a280
No known key found for this signature in database
GPG key ID: 5DEE9B97B0E2289A
4 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
tuf/client/updater.py
View file

@ -954,6 +954,9 @@ def _import_delegations(self, parent_role):
# for the key.
try:
# The repo may have used hashing algorithms for the generated keyids
# that doesn't match the client's set of hash algorithms. Make sure
# to only used the repo's selected hashing algorithms.
hash_algorithms = securesystemslib.settings.HASH_ALGORITHMS
securesystemslib.settings.HASH_ALGORITHMS = keyinfo['keyid_hash_algorithms']
key, keyids = securesystemslib.keys.format_metadata_to_key(keyinfo)

3
tuf/keydb.py
View file

@ -123,6 +123,9 @@ def create_keydb_from_root_metadata(root_metadata, repository_name='default'):
# default keyid listed in 'key_dict'. The additional keyids are
# generated according to securesystemslib.settings.HASH_ALGORITHMS.
# The repo may have used hashing algorithms for the generated keyids that
# doesn't match the client's set of hash algorithms. Make sure to only
# used the repo's selected hashing algorithms.
hash_algorithms = securesystemslib.settings.HASH_ALGORITHMS
securesystemslib.settings.HASH_ALGORITHMS = key_metadata['keyid_hash_algorithms']
key_dict, keyids = securesystemslib.keys.format_metadata_to_key(key_metadata)

4
tuf/repository_lib.py
View file

@ -685,6 +685,10 @@ def _load_top_level_metadata(repository, top_level_filenames, repository_name):
# Add the keys specified in the delegations field of the Targets role.
for key_metadata in six.itervalues(targets_metadata['delegations']['keys']):
# The repo may have used hashing algorithms for the generated keyids
# that doesn't match the client's set of hash algorithms. Make sure
# to only used the repo's selected hashing algorithms.
hash_algorithms = securesystemslib.settings.HASH_ALGORITHMS
securesystemslib.settings.HASH_ALGORITHMS = key_metadata['keyid_hash_algorithms']
key_object, keyids = securesystemslib.keys.format_metadata_to_key(key_metadata)

4
tuf/repository_tool.py
View file

@ -3024,6 +3024,10 @@ def load_repository(repository_directory, repository_name='default'):
# The repository maintainer should have also been made aware of the
# duplicate key when it was added.
for key_metadata in six.itervalues(metadata_object['delegations']['keys']):
# The repo may have used hashing algorithms for the generated keyids
# that doesn't match the client's set of hash algorithms. Make sure
# to only used the repo's selected hashing algorithms.
hash_algorithms = securesystemslib.settings.HASH_ALGORITHMS
securesystemslib.settings.HASH_ALGORITHMS = key_metadata['keyid_hash_algorithms']
key_object, keyids = securesystemslib.keys.format_metadata_to_key(key_metadata)