theupdateframework / theupdateframework/python-tuf

Snapshot and Timestamp default content

Open
#2,307 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
1.7k
Forks
304
Avg merge
1d 2h
Merged PRs (30d)
17

Description

Snapshot and Timestamp constructors try to be clever:

self.meta = meta if meta is not None else {"targets.json": MetaFile(1)}

and

self.snapshot_meta = snapshot_meta or MetaFile(1)

So they set the metafile content without knowing what it really should be

this is annoying as Repository.snapshot() and Repository.timestamp() now think a snapshot and timestamp are not needed -- even though none have been generated yet.

I can work around this but especially for snapshot the default value seems wrong: empty dict would be more correct -- the meta dict should be filled by a conscious decision not by a default value that might be right.

For timestamp there might not be a correct value though. I think MetaFile(0) would be best (although it requires loosening the check for valid MetaFiles): it's at least clear that timestamp doesn't have a snapshot version yet

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the Snapshot and Timestamp constructors and the Repository.snapshot() and Repository.timestamp() methods to understand how their default metadata affects generation checks. Compare the proposed empty-dict and MetaFile(0) defaults with the existing MetaFile validity rules; done means newly constructed objects do not falsely indicate that snapshot or timestamp metadata has been generated.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.