theupdateframework / theupdateframework/python-tuf
ngclient: max_root_rotations value is very small
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 304
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 17
Description
Please fill in the fields below to submit an issue or feature request. The
more information that is provided, the better.
Description of issue or feature request:
ngclient (like legacy client?) has a max_root_rotations value of 32, which feels low.
The specification suggests a value of 1024 (2^10)
Can we define a way of calculating a sane default for, i.e., PyPI users and update the default accordingly?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in tuf/ngclient/config.py at the max_root_rotations default, then compare it with the legacy client and the linked TUF specification section on update root. Determine how a sensible default should be calculated for PyPI users and update the configuration accordingly, with coverage for the resulting default behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100