theupdateframework / theupdateframework/rust-tuf

Client::update_root should update from N+1, not fetch the latest root metadata

Open
#292 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
198
Forks
39
Avg merge
9h 19m
Merged PRs (30d)
2

Description

The TUF spec states that the root metadata should be updated by continuing to try to update to version N+1 metadata until we get a not-found error. However, rust-tuf doesn't follow this scheme. Instead, Client::update_root fetches the latest root metadata, then sequentially updates from the current root version through the latest version. Unfortunately, this exposes the client to parsing untrusted TUF metadata. It's theoretically possible a parser exploit that could compromise a rust-tuf Client (see #291).

We should change Client::update_root to follow the spec to avoid this issue.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at Client::update_root and compare its current root-metadata update flow with the TUF specification. Trace how the current root version and fetched metadata are handled, then verify that updates proceed one version at a time and stop on a not-found response. Done means the client no longer fetches the latest root metadata first and the existing test suite passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.