theupdateframework / theupdateframework/python-tuf
Snapshot and Timestamp default content
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 304
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 17
Description
Snapshot and Timestamp constructors try to be clever:
self.meta = meta if meta is not None else {"targets.json": MetaFile(1)}
and
self.snapshot_meta = snapshot_meta or MetaFile(1)
So they set the metafile content without knowing what it really should be
this is annoying as Repository.snapshot() and Repository.timestamp() now think a snapshot and timestamp are not needed -- even though none have been generated yet.
I can work around this but especially for snapshot the default value seems wrong: empty dict would be more correct -- the meta dict should be filled by a conscious decision not by a default value that might be right.
For timestamp there might not be a correct value though. I think MetaFile(0) would be best (although it requires loosening the check for valid MetaFiles): it's at least clear that timestamp doesn't have a snapshot version yet
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the Snapshot and Timestamp constructors and the Repository.snapshot() and Repository.timestamp() methods to understand how their default metadata affects generation checks. Compare the proposed empty-dict and MetaFile(0) defaults with the existing MetaFile validity rules; done means newly constructed objects do not falsely indicate that snapshot or timestamp metadata has been generated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100