diff --git a/tuf/repo/signercli.py b/tuf/repo/signercli.py index 1618d35f..5c308095 100755 --- a/tuf/repo/signercli.py +++ b/tuf/repo/signercli.py @@ -1261,9 +1261,11 @@ def _update_parent_metadata(metadata_directory, delegated_role, delegated_keyids if role_index is None: # Append role to the end of the list of delegated roles. + logger.info('Appending role '+delegated_role+' to '+parent_role) roles.append(role_metadata) else: # Update role with the same name. + logger.info('Replacing role '+delegated_role+' in '+parent_role) roles[role_index] = role_metadata delegations['roles'] = roles diff --git a/tuf/repo/signerlib.py b/tuf/repo/signerlib.py index 5b8580d9..6eb88146 100755 --- a/tuf/repo/signerlib.py +++ b/tuf/repo/signerlib.py @@ -1148,10 +1148,10 @@ def build_delegated_role_file(delegated_targets_directory, delegated_keyids, delegation_role_name): """ - Build the targets metadata file using the signing keys in 'targets_keyids'. - The generated metadata file is saved to 'metadata_directory'. The target - files located in 'targets_directory' will be tracked by the built targets - metadata. + Build the targets metadata file using the signing keys in + 'delegated_keyids'. The generated metadata file is saved to + 'metadata_directory'. The target files located in 'targets_directory' will + be tracked by the built targets metadata. delegated_targets_directory: diff --git a/tuf/roledb.py b/tuf/roledb.py index feb44265..f6446731 100755 --- a/tuf/roledb.py +++ b/tuf/roledb.py @@ -538,7 +538,8 @@ def get_delegated_rolenames(rolename): None. - A list of rolenames. + A list of rolenames. Note that the rolenames are *NOT* sorted by order of + delegation! """ diff --git a/tuf/tests/test_signercli.py b/tuf/tests/test_signercli.py index ee36baa3..97a56f25 100755 --- a/tuf/tests/test_signercli.py +++ b/tuf/tests/test_signercli.py @@ -1468,8 +1468,13 @@ def _mock_get_keyids(junk): parent_role_file = os.path.join(meta_dir, parent_role+'.txt') signable = signerlib.read_metadata_file(parent_role_file) delegated_rolename = parent_role+'/'+delegated_role - threshold = signable['signed']['delegations']['roles']\ - [delegated_rolename]['threshold'] + + roles = signable['signed']['delegations']['roles'] + role_index = signerlib.find_delegated_role(roles, delegated_rolename) + self.assertIsNotNone(role_index) + role = roles[role_index] + + threshold = role['threshold'] self.assertTrue(threshold == 2) # RESTORE