theupdateframework / theupdateframework/rust-tuf
Client::update_root should verify fetched metadata is expected version
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 198
- Forks
- 39
- Avg merge
- 9h 19m
- Merged PRs (30d)
- 2
Description
When tuf::Client::update_root downloads root metadata from a server, it's currently not checking that that metadata's version matches the expected version. So this means if we are currently on version 5.root.json, when we try to download 6.root.json the server could actually give us version 7. We should make sure the metadata matches the expected version.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the tuf::Client::update_root entry point and trace how fetched root metadata is handled when requesting the next version. Verify the metadata version against the expected version, and confirm that a response for a different version is rejected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100