theupdateframework / theupdateframework/rust-tuf
Client::update_root should update from N+1, not fetch the latest root metadata
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 198
- Forks
- 39
- Avg merge
- 9h 19m
- Merged PRs (30d)
- 2
Description
The TUF spec states that the root metadata should be updated by continuing to try to update to version N+1 metadata until we get a not-found error. However, rust-tuf doesn't follow this scheme. Instead, Client::update_root fetches the latest root metadata, then sequentially updates from the current root version through the latest version. Unfortunately, this exposes the client to parsing untrusted TUF metadata. It's theoretically possible a parser exploit that could compromise a rust-tuf Client (see #291).
We should change Client::update_root to follow the spec to avoid this issue.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at Client::update_root and compare its current root-metadata update flow with the TUF specification. Trace how the current root version and fetched metadata are handled, then verify that updates proceed one version at a time and stop on a not-found response. Done means the client no longer fetches the latest root metadata first and the existing test suite passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100