cloudera/livy 930
Livy is an open source REST interface for interacting with Apache Spark from anywhere
Rust wrapper for libpcre
An example on how to have bonjour talk to zeromq
Temporary fork of LLVM for Rust
Mirror of celestia
rust-lang.org maintained cargo repository
Rust implementation of the Cache Conscious HashMap
Security advisory database for Rust crates published through crates.io
A string type for Rust that is not required to be valid UTF-8.
Mirror of official clang git repository located at http://llvm.org/git/clang. Updated hourly.
push eventheartsucker/rust-tuf
commit sha 1f9794641e5f7a076c51403b18ce4ee0a8a4f065
Add a RepoBuilder test repo builder This adds a helper library repo_builder::RepoBuilder, which allows tests to more easily create a test repository. Change-Id: I390dcb4621e6366366af710e71ad17383f1ce0db
commit sha dea81a783c0d54d7e7a9962f685dddebbdbe944e
Merge pull request #307 from erickt/repo-builder Add a RepoBuilder to simplify setting up repositories for testing
push time in 4 minutes
PR merged heartsucker/rust-tuf
This adds a helper library repo_builder::RepoBuilder, which allows tests to more easily create a test repository. This is a rewrite of #287 to remove some unrelated changes, and to simplify defining tests for the upcoming patch that allows rust-tuf to initialize trust from the local store upon client creation.
pr closed time in 4 minutes
push eventheartsucker/rust-tuf
commit sha a671f89b4cec5abad79859b4c9614524705d60e7
Fixup RepositoryProvider docs `Repository` is a private type, and rustdoc rightly complains when public docs refer to them. This change updates the reference to point to `Client`, which is the pub type that effectively enforces the constraints referenced in the docs.
commit sha bc82eb30ccebccbc42cd280967c914f5db12cc30
Merge pull request #308 from wellsie1116/docs Fixup RepositoryProvider docs
push time in 2 hours
PR merged heartsucker/rust-tuf
Repository is a private type, and rustdoc rightly complains when
public docs refer to them. This change updates the reference to point
to Client, which is the pub type that effectively enforces the
constraints referenced in the docs.
pr closed time in 2 hours
PR closed heartsucker/rust-tuf
This is a stack of a few patches. First, it introduces RepoBuilder, a helper builder that takes away some of the boilerplate for writing metadata. It's not complete though, so I've left it private and only exposed to tests. It needs the following fixed before I think we should expose it:
- Fetch and validate the old metadata before basing new metadata off of it.
- Don't overwrite metadata that already exists.
- Auto-increment the version numbers.
- Optionally allow the timestamp version number to be generated off of the current UTC time, to ease working with test repositories.
- Merge targets and delegates.
- Come up with a better way to handle delegation metadata.
- Add documentation and examples.
- Make a proper error for when
repo_builder::signis given an empty vec of private keys.
In addition, it adds and extends a of tests to use it, and finally, I found and fixed a bug that prevented delegated target descriptions from being fetched. I added a test for this as well to make sure it keeps working.
pr closed time in 2 hours
pull request commentheartsucker/rust-tuf
Add RepoBuilder metadata generator, and tests
Superseded by #307 (and some other patches that haven't been published yet).
comment created time in 2 hours
Pull request review commentgoogle/argh
Use command base name not full path.
impl From<String> for EarlyExit { } } +/// Extract the base cmd from a path+pub fn cmd<'a>(default: &'a String, path: &'a String) -> &'a str {
I don't think this function should be part of the public. Could you make this private, and move the test you defined in tests/lib.rs into src/lib.rs, and add it like:
...
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_cmd_extraction() {
let expected = "test_cmd";
let path = format!("/tmp/{}", expected);
let cmd = argh::cmd(&path, &path);
assert_eq!(expected, cmd);
}
}
comment created time in 2 hours
push eventheartsucker/rust-tuf
commit sha 47d8f1f184ea281d8b6153557988b6216e62b97a
Remove MetadataVersion::Hash TUF no longer supports prefixing metadata paths by a hash, so this removes support for them. Closes #254 Change-Id: Ife713d3e420e14861169aa5f2952f23dd0d2d5fd
commit sha c7ba933ef93bf2a1e5328d6c4b405b88a4edf1b1
Merge pull request #305 from erickt/remove-version-hash Remove MetadataVersion::Hash
push time in 4 hours
PR merged heartsucker/rust-tuf
TUF no longer supports prefixing metadata paths by a hash, so this removes support for them.
Closes #254
pr closed time in 4 hours
issue closedheartsucker/rust-tuf
According to the TUF-1.0 spec, metadata is only ever fetched unversioned, or by a specific version number, including delegations. Therefore we should be able to remove MetadataVersion::Hash.
closed time in 4 hours
erickt
issue commenttheupdateframework/specification
Define and document review expectations
Do we have a formal list of people who are TAP editors?
One option we could adopt (or fork) rust-lang's https://github.com/rust-lang/rfcbot-rs, which automates their process for making changes to the rust language. For example, see https://github.com/rust-lang/rfcs/pull/2963, where there's a formal process for calling for approval of a change, and the bot asks people that are part of the relevant team to vote to merge something in. I'm not sure how we would run it here though. Perhaps bots like this can be run as github actions?
Or we could just adopt a process like this by hand, since we really don't have that much churn on the spec.
comment created time in 4 hours
PR opened heartsucker/rust-tuf
This adds a helper library repo_builder::RepoBuilder, which allows tests to more easily create a test repository.
pr created time in 3 days
push eventerickt/rust-tuf
commit sha 1f9794641e5f7a076c51403b18ce4ee0a8a4f065
Add a RepoBuilder test repo builder This adds a helper library repo_builder::RepoBuilder, which allows tests to more easily create a test repository. Change-Id: I390dcb4621e6366366af710e71ad17383f1ce0db
commit sha b8d4138aa7b0fe61d26c8a9f33a2ab0b1aacf31a
Client::update should fail if we can't write metadata Previously, `Client::update` would warn, but ultimately ignore, if we failed to persist metadata to the local store. This doesn't play well with trying to use TUF offline. Consider the case where a client is doing an update for some new targets file. If we do an update, but we run out of space before writing the new targets file. If we reboot the device and lose our connection to the repository, we can no longer validate the old timestamp file. This patch changes the client to error when this happens. This would allow a user of `tuf::Client` to handle this error (like clearing some files from local storage before re-trying the update). If a user instead wants the old behavior, they could initialize a client with a local repository that only warns if an error occurs. Test: This adds a test case where where the client will err out if we fail to write an update. Change-Id: I31ffa2fc98353a16e73adeec6eb8da729784db92
push time in 3 days
push eventerickt/rust-tuf
commit sha 9cb6f9dc95187b84aac0ad45456c9da74e2e514d
Add a RepoMaker test repo builder This adds a helper library repo_maker::RepoMaker, which allows tests to more easily create a test repository. Change-Id: I390dcb4621e6366366af710e71ad17383f1ce0db
commit sha ca953c0ff7d53a4e1b05322330f9dd8210b74174
Client::update should fail if we can't write metadata Previously, `Client::update` would warn, but ultimately ignore, if we failed to persist metadata to the local store. This doesn't play well with trying to use TUF offline. Consider the case where a client is doing an update for some new targets file. If we do an update, but we run out of space before writing the new targets file. If we reboot the device and lose our connection to the repository, we can no longer validate the old timestamp file. This patch changes the client to error when this happens. This would allow a user of `tuf::Client` to handle this error (like clearing some files from local storage before re-trying the update). If a user instead wants the old behavior, they could initialize a client with a local repository that only warns if an error occurs. Test: This adds a test case where where the client will err out if we fail to write an update. Change-Id: I31ffa2fc98353a16e73adeec6eb8da729784db92
push time in 3 days
push eventerickt/rust-tuf
commit sha 55e6314f49a53db7fd29b24d6fbf316d76d97fe8
Change update_root to follow TUF-1.0.9 section 5.1 This switches Client::update_root to follow TUF-1.0.9 section 5.1 to update the root metadata. It now will fetch root N+1 until it receives a not-found error. Change-Id: I79147f64575ae8c1aa3fa418990d44e11a7d506b
commit sha 027efa5aef909084db6ffd027897884d8aee3833
Address comments, add more testing This adds a new test-only `TrackRepository` wrapper type, which allows most interactions with repository storage and providers to be captured and checked to make sure they are correct during testing. Note: This removes the `versioned_init` tests, since it is now redundant with the `chain_update_root` tests. Change-Id: I14ca6764a4f29cdc42afcd7b701e655bc10a9f2a
commit sha a5ea2c9650da10dee6bbbae6bcfe3540844a2115
Address comments * Fix a comment since TrackRepository only tracks metadata changes. * Error rather than panic if root version is 2^32 or above. * Add a fixme(#306) to add a limit on the number of root metadata fetch. Change-Id: I8adef8261108ee45630c407738372fb37e93c3b4
commit sha cf460811d79f98d8fe67ec2f44851d61c6151a5a
Merge pull request #302 from erickt/update-root Change update_root to follow TUF-1.0.9 section 5.1
commit sha 112e56db21eab8b0798f9b4f62ea0e8ece34f272
Add a RepoMaker test repo builder This adds a helper library repo_maker::RepoMaker, which allows tests to more easily create a test repository. Change-Id: I390dcb4621e6366366af710e71ad17383f1ce0db
commit sha 073db7283d56cbc3990fe37a50002c26f23732dd
Client::update should fail if we can't write metadata Previously, `Client::update` would warn, but ultimately ignore, if we failed to persist metadata to the local store. This doesn't play well with trying to use TUF offline. Consider the case where a client is doing an update for some new targets file. If we do an update, but we run out of space before writing the new targets file. If we reboot the device and lose our connection to the repository, we can no longer validate the old timestamp file. This patch changes the client to error when this happens. This would allow a user of `tuf::Client` to handle this error (like clearing some files from local storage before re-trying the update). If a user instead wants the old behavior, they could initialize a client with a local repository that only warns if an error occurs. Test: This adds a test case where where the client will err out if we fail to write an update. Change-Id: I31ffa2fc98353a16e73adeec6eb8da729784db92
push time in 3 days
push eventheartsucker/rust-tuf
commit sha 55e6314f49a53db7fd29b24d6fbf316d76d97fe8
Change update_root to follow TUF-1.0.9 section 5.1 This switches Client::update_root to follow TUF-1.0.9 section 5.1 to update the root metadata. It now will fetch root N+1 until it receives a not-found error. Change-Id: I79147f64575ae8c1aa3fa418990d44e11a7d506b
commit sha 027efa5aef909084db6ffd027897884d8aee3833
Address comments, add more testing This adds a new test-only `TrackRepository` wrapper type, which allows most interactions with repository storage and providers to be captured and checked to make sure they are correct during testing. Note: This removes the `versioned_init` tests, since it is now redundant with the `chain_update_root` tests. Change-Id: I14ca6764a4f29cdc42afcd7b701e655bc10a9f2a
commit sha a5ea2c9650da10dee6bbbae6bcfe3540844a2115
Address comments * Fix a comment since TrackRepository only tracks metadata changes. * Error rather than panic if root version is 2^32 or above. * Add a fixme(#306) to add a limit on the number of root metadata fetch. Change-Id: I8adef8261108ee45630c407738372fb37e93c3b4
commit sha cf460811d79f98d8fe67ec2f44851d61c6151a5a
Merge pull request #302 from erickt/update-root Change update_root to follow TUF-1.0.9 section 5.1
push time in 3 days
PR merged heartsucker/rust-tuf
This switches Client::update_root to follow TUF-1.0.9 section 5.1 to update the root metadata. It now will fetch root N+1 until it receives a not-found error.
Test: This behavior is checked by the current tests. We could add a new test that makes sure we don't fetch root.json, but I'm not sure we get much value from a test like that.
pr closed time in 3 days
push eventerickt/rust-tuf
commit sha a5ea2c9650da10dee6bbbae6bcfe3540844a2115
Address comments * Fix a comment since TrackRepository only tracks metadata changes. * Error rather than panic if root version is 2^32 or above. * Add a fixme(#306) to add a limit on the number of root metadata fetch. Change-Id: I8adef8261108ee45630c407738372fb37e93c3b4
push time in 3 days
Pull request review commentheartsucker/rust-tuf
Change update_root to follow TUF-1.0.9 section 5.1
impl<D: DataInterchange> Tuf<D> { // discard it, abort the update cycle, and report the rollback attack. On the next // update cycle, begin at step 0 and version N of the root metadata file. - // Next, make sure the new root has a higher version than the old root.- if new_root.version() == trusted_root.version() {- info!(- "Attempted to update root to new metadata with the same version. \- Refusing to update."- );- return Ok(false);- } else if new_root.version() < trusted_root.version() {+ let next_root_version = trusted_root+ .version()+ .checked_add(1)+ .expect("root version should be less than max u32");
Sure, I'll switch. We'd never trip over this in practice though because the new root would fail to deserialize a 2^32 value into a u32.
We could bump the version numbers up to a u64 are worthwhile, but consider the case where it only took 1 millisecond to create or fetch a root metadata. Trying to generate or fetch (2^32-1) - N would still take approximately 50 days. Repositories and clients should instead have separate monitoring in place to catch runaway processes like that.
comment created time in 3 days
Pull request review commentheartsucker/rust-tuf
Change update_root to follow TUF-1.0.9 section 5.1
+use {+ crate::{+ crypto::{HashAlgorithm, HashValue},+ interchange::DataInterchange,+ metadata::{MetadataPath, MetadataVersion, TargetDescription, TargetPath},+ repository::{RepositoryProvider, RepositoryStorage},+ Result,+ },+ futures_io::AsyncRead,+ futures_util::{+ future::{BoxFuture, FutureExt},+ io::{AsyncReadExt, Cursor},+ },+ parking_lot::Mutex,+ std::sync::Arc,+};++#[derive(Debug, PartialEq)]+pub(crate) enum Track {+ Store {+ path: MetadataPath,+ version: MetadataVersion,+ metadata: String,+ },+ FetchFound {+ path: MetadataPath,+ version: MetadataVersion,+ metadata: String,+ },+ FetchErr(MetadataPath, MetadataVersion),+}++impl Track {+ pub(crate) fn store<T>(meta_path: &MetadataPath, version: &MetadataVersion, metadata: T) -> Self+ where+ T: Into<Vec<u8>>,+ {+ Track::Store {+ path: meta_path.clone(),+ version: version.clone(),+ metadata: String::from_utf8(metadata.into()).unwrap(),+ }+ }++ pub(crate) fn fetch_found<T>(+ meta_path: &MetadataPath,+ version: &MetadataVersion,+ metadata: T,+ ) -> Self+ where+ T: Into<Vec<u8>>,+ {+ Track::FetchFound {+ path: meta_path.clone(),+ version: version.clone(),+ metadata: String::from_utf8(metadata.into()).unwrap(),+ }+ }+}++/// Helper Repository wrapper that tracks all the fetches and stores for testing purposes.
Fixed, thanks.
comment created time in 3 days
Pull request review commentheartsucker/rust-tuf
Change update_root to follow TUF-1.0.9 section 5.1
where async fn update_root(&mut self) -> Result<bool> { let root_path = MetadataPath::from_role(&Role::Root); - // We don't follow the TUF-1.0.9 §5.1 on how to update the root metadata. It states:- //- // TUF-1.0.9 §5.1.2:- //- // Try downloading version N+1 of the root metadata file, up to some W number of- // bytes (because the size is unknown). The value for W is set by the authors of- // the application using TUF. For example, W may be tens of kilobytes. The filename- // used to download the root metadata file is of the fixed form- // VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,- // or we have downloaded more than Y number of root metadata files (because the- // exact number is as yet unknown), then go to step 5.1.9. The value for Y is set- // by the authors of the application using TUF. For example, Y may be 2^10.- //- // Instead, we fetch the latest available metadata (lets call the current version N and the- // latest version N+M), then we re-fetch all the metadata in betwee N and N+M.- //- // FIXME(#292): Consider rewriting this logic to follow the spec. By following the spec, we- // avoid the issue of having to use metadata (in order to extract the metadata version- // number) before we've verified it was signed correctly.- let raw_latest_root = self- .remote- .fetch_metadata(- &root_path,- &MetadataVersion::None,- self.config.max_root_length,- None,- )- .await?;+ let mut updated = false; - // Root metadata is signed by its own keys, but we should only trust it if it is also- // signed by the previous root metadata, which we can't check without knowing what version- // this root metadata claims to be.- let latest_version = {- // FIXME(#292): See the note above.- let latest_root = raw_latest_root.parse_untrusted()?;- latest_root.parse_version_untrusted()?- };-- if latest_version < self.tuf.trusted_root().version() {- return Err(Error::VerificationFailure(format!(- "Latest root version is lower than current root version: {} < {}",- latest_version,- self.tuf.trusted_root().version()- )));- } else if latest_version == self.tuf.trusted_root().version() {- return Ok(false);- }-- let err_msg = "TUF claimed no update occurred when one should have. \- This is a programming error. Please report this as a bug.";+ loop {+ /////////////////////////////////////////+ // TUF-1.0.9 §5.1.2:+ //+ // Try downloading version N+1 of the root metadata file, up to some W number of+ // bytes (because the size is unknown). The value for W is set by the authors of+ // the application using TUF. For example, W may be tens of kilobytes. The filename+ // used to download the root metadata file is of the fixed form+ // VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,+ // or we have downloaded more than Y number of root metadata files (because the
Oops, good catch. I filed #306 and added a FIXME to track that.
comment created time in 3 days
issue openedheartsucker/rust-tuf
Consider adding an upper bound on the number of root metadata we'll fetch in Client::update_root
TUF-1.0.9 §5.1.2 states:
Try downloading version N+1 of the root metadata file, up to some W number of
bytes (because the size is unknown). The value for W is set by the authors of
the application using TUF. For example, W may be tens of kilobytes. The filename
used to download the root metadata file is of the fixed form
VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,
or we have downloaded more than Y number of root metadata files (because the
exact number is as yet unknown), then go to step 5.1.9. The value for Y is set
by the authors of the application using TUF. For example, Y may be 2^10.
We do not have an upper bound on the number of root metadata we'll fetch. This means that an attacker that's stolen the root keys could cause a client to fall into an infinite loop (but if an attacker has stolen the root keys, the client probably has worse problems to worry about).
created time in 3 days
PR opened heartsucker/rust-tuf
TUF no longer supports prefixing metadata paths by a hash, so this removes support for them.
Closes #254
pr created time in 3 days
Pull request review commentheartsucker/rust-tuf
Change update_root to follow TUF-1.0.9 section 5.1
where async fn update_root(&mut self) -> Result<bool> { let root_path = MetadataPath::from_role(&Role::Root); - // We don't follow the TUF-1.0.9 §5.1 on how to update the root metadata. It states:- //- // TUF-1.0.9 §5.1.2:- //- // Try downloading version N+1 of the root metadata file, up to some W number of- // bytes (because the size is unknown). The value for W is set by the authors of- // the application using TUF. For example, W may be tens of kilobytes. The filename- // used to download the root metadata file is of the fixed form- // VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,- // or we have downloaded more than Y number of root metadata files (because the- // exact number is as yet unknown), then go to step 5.1.9. The value for Y is set- // by the authors of the application using TUF. For example, Y may be 2^10.- //- // Instead, we fetch the latest available metadata (lets call the current version N and the- // latest version N+M), then we re-fetch all the metadata in betwee N and N+M.- //- // FIXME(#292): Consider rewriting this logic to follow the spec. By following the spec, we- // avoid the issue of having to use metadata (in order to extract the metadata version- // number) before we've verified it was signed correctly.- let raw_latest_root = self- .remote- .fetch_metadata(- &root_path,- &MetadataVersion::None,- self.config.max_root_length,- None,- )- .await?;+ let mut updated = false; - // Root metadata is signed by its own keys, but we should only trust it if it is also- // signed by the previous root metadata, which we can't check without knowing what version- // this root metadata claims to be.- let latest_version = {- // FIXME(#292): See the note above.- let latest_root = raw_latest_root.parse_untrusted()?;- latest_root.parse_version_untrusted()?- };-- if latest_version < self.tuf.trusted_root().version() {- return Err(Error::VerificationFailure(format!(- "Latest root version is lower than current root version: {} < {}",- latest_version,- self.tuf.trusted_root().version()- )));- } else if latest_version == self.tuf.trusted_root().version() {- return Ok(false);- }-- let err_msg = "TUF claimed no update occurred when one should have. \- This is a programming error. Please report this as a bug.";+ loop {+ /////////////////////////////////////////+ // TUF-1.0.9 §5.1.2:+ //+ // Try downloading version N+1 of the root metadata file, up to some W number of+ // bytes (because the size is unknown). The value for W is set by the authors of+ // the application using TUF. For example, W may be tens of kilobytes. The filename+ // used to download the root metadata file is of the fixed form+ // VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,+ // or we have downloaded more than Y number of root metadata files (because the
No, Y in our case is self.config.max_root_length down on line 484. By default it's 1 MiB.
comment created time in 4 days
Pull request review commentheartsucker/rust-tuf
Change update_root to follow TUF-1.0.9 section 5.1
where async fn update_root(&mut self) -> Result<bool> { let root_path = MetadataPath::from_role(&Role::Root); - // We don't follow the TUF-1.0.9 §5.1 on how to update the root metadata. It states:- //- // TUF-1.0.9 §5.1.2:- //- // Try downloading version N+1 of the root metadata file, up to some W number of- // bytes (because the size is unknown). The value for W is set by the authors of- // the application using TUF. For example, W may be tens of kilobytes. The filename- // used to download the root metadata file is of the fixed form- // VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,- // or we have downloaded more than Y number of root metadata files (because the- // exact number is as yet unknown), then go to step 5.1.9. The value for Y is set- // by the authors of the application using TUF. For example, Y may be 2^10.- //- // Instead, we fetch the latest available metadata (lets call the current version N and the- // latest version N+M), then we re-fetch all the metadata in betwee N and N+M.- //- // FIXME(#292): Consider rewriting this logic to follow the spec. By following the spec, we- // avoid the issue of having to use metadata (in order to extract the metadata version- // number) before we've verified it was signed correctly.- let raw_latest_root = self- .remote- .fetch_metadata(- &root_path,- &MetadataVersion::None,- self.config.max_root_length,- None,- )- .await?;+ let mut updated = false; - // Root metadata is signed by its own keys, but we should only trust it if it is also- // signed by the previous root metadata, which we can't check without knowing what version- // this root metadata claims to be.- let latest_version = {- // FIXME(#292): See the note above.- let latest_root = raw_latest_root.parse_untrusted()?;- latest_root.parse_version_untrusted()?- };-- if latest_version < self.tuf.trusted_root().version() {- return Err(Error::VerificationFailure(format!(- "Latest root version is lower than current root version: {} < {}",- latest_version,- self.tuf.trusted_root().version()- )));- } else if latest_version == self.tuf.trusted_root().version() {- return Ok(false);- }-- let err_msg = "TUF claimed no update occurred when one should have. \- This is a programming error. Please report this as a bug.";+ loop {+ /////////////////////////////////////////+ // TUF-1.0.9 §5.1.2:+ //+ // Try downloading version N+1 of the root metadata file, up to some W number of+ // bytes (because the size is unknown). The value for W is set by the authors of+ // the application using TUF. For example, W may be tens of kilobytes. The filename+ // used to download the root metadata file is of the fixed form+ // VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,+ // or we have downloaded more than Y number of root metadata files (because the+ // exact number is as yet unknown), then go to step 5.1.9. The value for Y is set+ // by the authors of the application using TUF. For example, Y may be 2^10.++ let next_version = MetadataVersion::Number(self.tuf.trusted_root().version() + 1);+ let res = self+ .remote+ .fetch_metadata(&root_path, &next_version, self.config.max_root_length, None)+ .await; - for i in (self.tuf.trusted_root().version() + 1)..latest_version {- let version = MetadataVersion::Number(i);+ let raw_signed_root = match res {+ Ok(raw_signed_root) => raw_signed_root,+ Err(Error::NotFound) => {+ break;+ }+ Err(err) => {+ return Err(err);+ }+ }; - // FIXME(#292): See the note above.- let raw_signed_root = self- .remote- .fetch_metadata(&root_path, &version, self.config.max_root_length, None)- .await?;+ updated = true; if !self.tuf.update_root(&raw_signed_root)? {
Yeah this was weird. I fixed that in another patch I'm working on, I'll pull it back here.
comment created time in 4 days
push eventerickt/rust-tuf
commit sha 027efa5aef909084db6ffd027897884d8aee3833
Address comments, add more testing This adds a new test-only `TrackRepository` wrapper type, which allows most interactions with repository storage and providers to be captured and checked to make sure they are correct during testing. Note: This removes the `versioned_init` tests, since it is now redundant with the `chain_update_root` tests. Change-Id: I14ca6764a4f29cdc42afcd7b701e655bc10a9f2a
push time in 4 days
PR opened heartsucker/rust-tuf
Previously, Client::update would warn, but ultimately ignore, if we failed to persist metadata to the local store. This doesn't play well with trying to use TUF offline.
Consider the case where a client is doing an update for some new targets file. If we do an update, but we run out of space before writing the new targets file. If we reboot the device and lose our connection to the repository, we can no longer validate the old timestamp file.
This patch changes the client to error when this happens. This would allow a user of tuf::Client to handle this error (like clearing some files from local storage before re-trying the update). If a user instead wants the old behavior, they could initialize a client with a local repository that only warns if an error occurs.
Test: This adds a test case where where the client will err out if we fail to write an update.
pr created time in 4 days
push eventerickt/rust-tuf
commit sha 7925a0ade50d81552be8add49e86fbc763d422ca
Client::update should fail if we can't write metadata Previously, `Client::update` would warn, but ultimately ignore, if we failed to persist metadata to the local store. This doesn't play well with trying to use TUF offline. Consider the case where a client is doing an update for some new targets file. If we do an update, but we run out of space before writing the new targets file. If we reboot the device and lose our connection to the repository, we can no longer validate the old timestamp file. This patch changes the client to error when this happens. This would allow a user of `tuf::Client` to handle this error (like clearing some files from local storage before re-trying the update). If a user instead wants the old behavior, they could initialize a client with a local repository that only warns if an error occurs. Test: This adds a test case where where the client will err out if we fail to write an update. Change-Id: I31ffa2fc98353a16e73adeec6eb8da729784db92
push time in 4 days
PR opened heartsucker/rust-tuf
This makes sure that all the tuf::Client tests go through the test_versioned_inits.
pr created time in 4 days
PR opened heartsucker/rust-tuf
This switches Client::update_root to follow TUF-1.0.9 section 5.1 to update the root metadata. It now will fetch root N+1 until it receives a not-found error.
Test: This behavior is checked by the current tests. We could add a new test that makes sure we don't fetch root.json, but I'm not sure we get much value from a test like that.
pr created time in 4 days
issue commenttheupdateframework/taps
Allowing TAPs that are licensed with MIT or Apache 2.0?
@JustinCappos: Good morning! Has there been any word from Chris A?
comment created time in 7 days
push eventerickt/tuf-specification
commit sha 7a43bd6f120377a4cfab0c65698c8f7c1819ccd1
More definitions, and calling out examples
push time in 7 days
issue openedtabatkins/bikeshed
Difficult to click on an example link on Chrome 86 with default CSS
I'm finding the hitbox for getting an example on Chrome 86 to be quite tiny with the default CSS. For example, for https://tabatkins.github.io/bikeshed/#example-e79df413, it seems the hitbox is approximately 2 pixels wide. In comparison, it looks like whatwg style has this rule:
a.self-link::before {
content: "¶";
}
You can see this in use here: https://url.spec.whatwg.org/#example-12672b6a. Would it be worthwhile adding something like that in the default CSS?
created time in 8 days
push eventerickt/tuf-specification
commit sha 974c1089bb040a4b07799b36af2db11619b25dfc
Add definitions for section 4.2
commit sha bcfb1e9585ee13e47271e87efe4ebb3402bef0d7
Add definitions to root.json format
push time in 10 days
push eventheartsucker/rust-tuf
commit sha 331d96624a93dc1326cba794c7670d1df3c1c8c2
Persist unversioned metadata to local store The TUF-1.0.9 spec states that the metadata should be written to non-volatile storage as an unversioned path after verification. This also keeps the extension where we also persist the versioned root metadata. This allows a client to be initialized first from an trusted root metadata (which could be stored in read-only storage), then load metadata from the local store, and finally then the remote metadata. Change-Id: Id62685db069b65e094666c97464583df4c2a1163
commit sha de626769c207ce84624277d811ba2af5c4dc733a
Fix typo Change-Id: I81d1718a78e752b8db4fac1da36127fb009dc8ee
commit sha 74af84d0bf26eea5beca1c049d2d3c8b03b1c680
Merge remote-tracking branch 'remotes/origin/upstream/develop' into persist Change-Id: I0dfff9a79215ade0a7793958fb1e2644e2c1df9d
commit sha ad3cba03f0b5bfd5c3aca67a6364ec5c25bc7134
Address comments Change-Id: I6a301385cf9cee8ef525f2dfc385df16195ed466
commit sha bb39420da8c082126c9ae71d33afa01114991a29
Address the rest of the comments Change-Id: I8ac912fb46c66966358b3ee236a6b7d5979f6afc
commit sha 36d5fbd35c3cc5b369de4d68adf855a40374afc7
Merge pull request #300 from erickt/persist Persist unversioned metadata to local store
push time in 11 days
PR merged heartsucker/rust-tuf
The TUF-1.0.9 spec states that the metadata should be written to non-volatile storage as an unversioned path after verification.
pr closed time in 11 days
push eventerickt/rust-tuf
commit sha bb39420da8c082126c9ae71d33afa01114991a29
Address the rest of the comments Change-Id: I8ac912fb46c66966358b3ee236a6b7d5979f6afc
push time in 11 days
Pull request review commentheartsucker/rust-tuf
Persist unversioned metadata to local store
where .update_delegation(&targets_role, delegation.role(), &raw_signed_meta) { Ok(_) => {+ /////////////////////////////////////////+ // TUF-1.0.9 §5.2.4:+ //+ // Persist timestamp metadata. The client MUST write the file to+ // non-volatile storage as FILENAME.EXT (e.g. timestamp.json).+
good catch, thanks.
comment created time in 11 days
push eventerickt/tuf-specification
commit sha 1bee014d2047d0d92237452335b980ccce1fa866
Fix warnings
commit sha 8d867bf165ddb52f37d7a6ae6b269574826bb616
re-indent, format codeblocks, and use definition lists
push time in 12 days
Pull request review commentheartsucker/rust-tuf
Persist unversioned metadata to local store
where // Only store the metadata after we have validated it. if fetched { client- .store_metadata(&root_path, &root_version, &raw_root)+ .store_metadata(&root_path, &MetadataVersion::None, &raw_root)
I'll remove this change. I think we'd only run into this if we called Client::with_trusted_root_keys with MetadataVersion::None. We probably should make that impossible though. I don't think it's safe to assume we can always trust that the initial trusted keys have always signed the latest root metadata.
comment created time in 13 days
Pull request review commentheartsucker/rust-tuf
Persist unversioned metadata to local store
where ) .await?; - if let Some(updated_timestamp) = self.tuf.update_timestamp(&raw_signed_timestamp)? {- let latest_version = MetadataVersion::Number(updated_timestamp.version());- self.store_metadata(×tamp_path, &latest_version, &raw_signed_timestamp)- .await;+ if self.tuf.update_timestamp(&raw_signed_timestamp)?.is_some() {+ /////////////////////////////////////////+ // TUF-1.0.9 §5.2.4:+ //+ // Persist timestamp metadata. The client MUST write the file to non-volatile+ // storage as FILENAME.EXT (e.g. timestamp.json).++ self.store_metadata(+ ×tamp_path,+ &MetadataVersion::None,
While technically it's a breaking change, it's safe because tuf::Client doesn't actually use the local cache of the timestamp metadata. In fact, the only time we actually use the local store is in Client::with_trusted_root_keys, when we fetch the initial trusted root. There's no other place that reads from the store, other than tests.
It's possible someone could be relying on the side effect of these files being written out to local storage, but I'm not aware of anyone else actually using rust-tuf, so this should be safe.
comment created time in 13 days
Pull request review commentheartsucker/rust-tuf
Persist unversioned metadata to local store
where return Err(Error::Programming(err_msg.into())); } + /////////////////////////////////////////+ // TUF-1.0.9 §5.1.7:+ //+ // Persist root metadata. The client MUST write the file to non-volatile storage as+ // FILENAME.EXT (e.g. root.json).++ self.store_metadata(&root_path, &MetadataVersion::None, &raw_signed_root)+ .await;++ // FIXME: This isn't a part of the spec, but we also store the versioned metadata. This+ // allows us to initialize a repository from the local metadata.
Sure, I'll switch to calling this a "NOTE". I used "FIXME" since I wanted to eventually get this updated in the spec (see https://github.com/theupdateframework/specification/issues/108).
comment created time in 13 days
Pull request review commentheartsucker/rust-tuf
Persist unversioned metadata to local store
where for i in (self.tuf.trusted_root().version() + 1)..latest_version { let version = MetadataVersion::Number(i); + /////////////////////////////////////////+ // TUF-1.0.9 §5.1.2:+ //+ // Try downloading version N+1 of the root metadata file, up to some W number of+ // bytes (because the size is unknown). The value for W is set by the authors of+ // the application using TUF. For example, W may be tens of kilobytes. The filename+ // used to download the root metadata file is of the fixed form+ // VERSION_NUMBER.FILENAME.EXT (e.g., 42.root.json). If this file is not available,+ // or we have downloaded more than Y number of root metadata files (because the+ // exact number is as yet unknown), then go to step 5.1.9. The value for Y is set+ // by the authors of the application using TUF. For example, Y may be 2^10.
Sure, I can add a reference to https://github.com/heartsucker/rust-tuf/issues/292 here.
comment created time in 13 days
Pull request review commentheartsucker/rust-tuf
Persist unversioned metadata to local store
where return Err(Error::Programming(err_msg.into())); } + /////////////////////////////////////////+ // TUF-1.0.9 §5.1.7:+ //+ // Persist root metadata. The client MUST write the file to non-volatile storage as+ // FILENAME.EXT (e.g. root.json).++ self.store_metadata(&root_path, &MetadataVersion::None, &raw_signed_root)+ .await;++ // FIXME: This isn't a part of the spec, but we also store the versioned metadata. This+ // allows us to initialize a repository from the local metadata. self.store_metadata(&root_path, &version, &raw_signed_root) .await;++ /////////////////////////////////////////+ // TUF-1.0.9 §5.1.8:+ //+ // Repeat steps 5.1.1 to 5.1.8. } if !self.tuf.update_root(&raw_latest_root)? { error!("{}", err_msg); return Err(Error::Programming(err_msg.into())); } - let latest_version = MetadataVersion::Number(latest_version);+ /////////////////////////////////////////+ // TUF-1.0.9 §5.1.7:+ //+ // Persist root metadata. The client MUST write the file to non-volatile storage as+ // FILENAME.EXT (e.g. root.json). - self.store_metadata(&root_path, &latest_version, &raw_latest_root)- .await; self.store_metadata(&root_path, &MetadataVersion::None, &raw_latest_root) .await; + // FIXME: This isn't a part of the spec, but we also store the versioned metadata. This+ // allows us to initialize a repository from the local metadata.+ self.store_metadata(+ &root_path,+ &MetadataVersion::Number(latest_version),+ &raw_latest_root,+ )+ .await;++ /////////////////////////////////////////+ // TUF-1.0.9 §5.1.9:+ //+ // Check for a freeze attack. The latest known time MUST be lower than the expiration+ // timestamp in the trusted root metadata file (version N). If the trusted root+ // metadata file has expired, abort the update cycle, report the potential freeze+ // attack. On the next update cycle, begin at step 5.0 and version N of the root+ // metadata file.++ // FIXME: we should move this logic into TUF to make it easier to review we implement the+ // TUF spec.
I'll rephrase this comment. We're checking the timestamp/snapshot/targets metadata for expiration in tuf::Tuf, I'd eventually like to move the root metadata expiration check into tuf::Tuf in order to reduce code duplication, and make it easier to audit rust-tuf's implementation of the spec, but I didn't want to go that far in this PR.
comment created time in 13 days
push eventerickt/rust-tuf
commit sha ad3cba03f0b5bfd5c3aca67a6364ec5c25bc7134
Address comments Change-Id: I6a301385cf9cee8ef525f2dfc385df16195ed466
push time in 13 days
push eventerickt/tuf-specification
commit sha e00b2fc565c9ac2950a8c6ce54412b61c57f9a98
prep bikeshed
commit sha fe48bbb3c27c5d8f287d37aa20a4ae06f18010e2
experiment with github actions
push time in 13 days
push eventerickt/tuf-specification
commit sha 9f1e73a6d1ee35d6efa43e394a7e3a4c68f5e05b
Fix a typo in section 5.3.1 It looks like an extra newline and bullet point was accidentally introduced in section 5.3.1. This removes it, and re-wraps the section.
commit sha a985ea9ea4a35f73bffd6727dcb07aba34380798
Fix a misspelling of snapshot
commit sha 9b1ad53d068a9d00055c54ea014dc65dda75dc20
Merge pull request #26 from erickt/patch-3 Fix a misspelling of snapshot
commit sha f5a6f00a2a5d8c4b05e24bbe5de718aa09da167c
Merge pull request #25 from erickt/patch-1 Fix a typo in section 5.3.1
commit sha 2b4e18472fe25d5b57f36f6fa50104967c8faeaa
minor: fix sentence
commit sha 86ca2d4df85b9a6ea6985b8ae74f091f1ee4eadb
Merge pull request #29 from hannesm/minor minor: fix sentence
commit sha 99dbf9af48c9d8c3cc78ce1b8d185df10aa8c503
Removing (Draft)
commit sha a2d9d90166908f340faa7acef66a85dd51be67c1
Remove some duplicated words Remove some duplicated words in tuf-spec.md
commit sha e69916da337cb858d349a889ae15148cd1821c35
Merge pull request #34 from huynq0911/fix_duplicated_word Remove some duplicated words
commit sha 1a6f2b73c315da49455f1ce2447199b14eb9a59a
Slightly clarifying provenance / early history... It's odd to fix this so late in the project's lifecycle, but the spec should probably be a bit more accurate in describing the history of TUF and Thandy. Jake and Roger visited UW (while Justin S. and Justin C. were there) and the brainstorming discussions we had there laid the groundwork for Thandy, which Nick, Jake, Roger, and possibly others I am unaware of designed. The Thandy authors then reached out to Justin S. and Justin C. to examine Thandy. The creation of TUF (by Justin S. and Justin C.) came from looking at issues with Thandy where we thought security could be improved (e.g., the lack of a snapshot role). We also tried to build TUF as a library so that others did not need to do a design like Thandy in order to have a secure updater. Note, this is my recollection of events and memory is not perfect. If someone else has a different recollection about any of my "facts" above, please let me know and I can adjust or annotate what is written.
commit sha 30625204c8d97021bbac20281363fa0486c5e68e
Update README.rst
commit sha daae73130d4ce447c55b5f7b466a0da1d70997bb
0.9 timestamp example was missing "version" The 0.9 tuf spec in section 4.6 mentions that "version" is included in the signed portion of timestamp.json, but was missing from the example file. This adds it. Feel free to reject this patch if you want to leave 0.9 as a historical document.
commit sha 215c56996fbe7e4de8afcabef1c9dbec07670f9e
Merge pull request #37 from erickt/patch-4 0.9 timestamp example was missing "version"
commit sha 454d4b75080c2c7905d103f06d3ab0fc0802c10f
Recommend against leading path separators In https://github.com/theupdateframework/tuf/pull/679, the python tuf project forbade leading path separators due to surprising behavior joining target and delegated paths, since Python in particular has the following surprising behavior: ``` >>> os.path.join("/foo", "/bar") '/bar' ``` This PR updates the spec to recommend against using leading path separators in targets.json, and removes their use from the examples. Does this change look acceptable, and is "should not" be the correct phrase, or can this be the more strict "must not"?
commit sha 28250513c270a8effaedd539e8d2c4d5cce50a70
PR revision: minor: typo fixes Signed-off-by: Sebastien Awwad <[email protected]>
commit sha 0c42560472848fc7a45066a4991e1867f038cd6f
In 0.9, fix history notes on early TUF (clone's Justin's edits) Apply the edits made on notes about the early history of TUF in the 1.0 spec to the 0.9 version of the specification as well. Signed-off-by: Sebastien Awwad <[email protected]>
commit sha 094800da17b4dff8ae23ecb0b817bbc9394b3d5a
Merge pull request #35 from theupdateframework/JustinCappos-TUF-history Slightly clarifying provenance / early history...
commit sha 091e1160e68f5bff1c74cf217f595b1a71eec092
Fix typo in detailed workflows
commit sha bc97d9660bb6b9234fa3d41140978344ce698b84
Merge pull request #44 from radu-matei/patch-1 Fix typo in detailed workflows
commit sha 7cf7de02132ff398f51287d4098151367d3bc5e7
Limit on the # of root metadata files downloaded
push time in 13 days
push eventerickt/tuf-specification
commit sha d93abbc27b4300170cbc0487f1c3b54c3484e531
experiment with github actions
push time in 13 days
push eventerickt/specification
commit sha 52ff8b82f126dd404aec8599e2a9da610352a623
experiment with github actions
push time in 13 days
push eventerickt/specification
commit sha 6e8e4721a4985a8f6c0ef5f21884dde46e0c6341
experiment with github actions
push time in 13 days
push eventerickt/specification
commit sha cf302d40b92a6853dc0726a341385e71e4ced1d5
experiment with github actions
push time in 13 days
Pull request review commentheartsucker/rust-tuf
Persist unversioned metadata to local store
where // Only store the metadata after we have validated it. if fetched { client- .store_metadata(&root_path, &root_version, &raw_root)+ .store_metadata(&root_path, &MetadataVersion::None, &raw_root) .await; - // FIXME: should we also store the root as `MetadataVersion::None`?+ // FIXME: This isn't a part of the spec, but we also store the versioned metadata. This+ // allows us to initialize a repository from the local emtadata.
Fixed, thanks.
comment created time in 14 days
push eventerickt/rust-tuf
commit sha a13f829e8bf2b777759ccaaf3a8386a0991fe3c4
Cite TUF spec, move timestamp expiry check to end. This adds direct citations of the TUF-1.0.5 spec in the `Tuf` client to make it easier for reviewers to directly see how each code block implements the spec, or how we diverge from it. It makes one minor code change. Previously the timestamp expiration was performed after signature verification. This moves the expiration check to be the last check to match the spec. Change-Id: I4125ff4d2e40abdbb177c03665d591b5c90e1794
commit sha 7f332eb516cb0d9c8ad25833fd6328b208c29ee4
Merge pull request #299 from erickt/cite Cite TUF spec, move timestamp expiry check to end.
commit sha de626769c207ce84624277d811ba2af5c4dc733a
Fix typo Change-Id: I81d1718a78e752b8db4fac1da36127fb009dc8ee
commit sha 74af84d0bf26eea5beca1c049d2d3c8b03b1c680
Merge remote-tracking branch 'remotes/origin/upstream/develop' into persist Change-Id: I0dfff9a79215ade0a7793958fb1e2644e2c1df9d
push time in 14 days
push eventgoogle/argh
commit sha c728c85810957bbf70e0b3287dc4e3c12a4fff5f
Fix quoting in errors when parsing arguments This closes quotes in error messages when parsing arguments. Test: Added tests to make sure the error message when parsing arguments is as expected, as well as added a test to check parsing options. Closes #52
commit sha d6abe829614e2475ac23ad8378f23e14f9207023
Merge pull request #64 from erickt/parse-errors Fix quoting in errors when parsing arguments
push time in 14 days
PR merged google/argh
This closes quotes in error messages when parsing arguments.
Test: Added tests to make sure the error message when parsing arguments is as expected, as well as added a test to check parsing options.
Closes #52
pr closed time in 14 days
issue closedgoogle/argh
A single quote is missing in the "Error parsing positional argument" message
I tried:
#[derive(argh::FromArgs)]
#[argh(description = "...")]
struct Args {
#[argh(positional)]
n: usize,
}
When I ran cargo run invalid-argument, it printed:
Error parsing positional argument 'n' with value 'invalid-argument: invalid digit found in string
A single quote was missing. It should be Error parsing positional argument 'n' with value 'invalid-argument': invalid digit found in string, just like error messages for non-positional arguments:
https://github.com/google/argh/blob/8d9a82f46634a4dd2600872f93e449cf23eb5299/src/lib.rs#L429
Corresponding source code:
https://github.com/google/argh/blob/8d9a82f46634a4dd2600872f93e449cf23eb5299/src/lib.rs#L448
A single quote should be inserted after arg.
closed time in 14 days
hyd-dev
push eventgoogle/argh
commit sha e91274f26b8c26b44180c74221beb585963c790c
Remove lockfile Closes #55
commit sha 14fc76dc2e91957b970a58231e53f09d9601a6c6
Merge pull request #66 from erickt/remove-lock Remove lockfile
push time in 14 days
PR merged google/argh
Closes #55
pr closed time in 14 days
issue closedgoogle/argh
Add `Cargo.lock` to `.gitignore`
It is recommended not to track Cargo.lock in Rust libraries, and to track it for binaries only. argh is a library. Shouldn't we add it to .gitignore ?
closed time in 14 days
victordeleau
PR opened google/argh
Closes #55
pr created time in 14 days
push eventerickt/argh
commit sha e91274f26b8c26b44180c74221beb585963c790c
Remove lockfile Closes #55
push time in 14 days
issue commenttheupdateframework/specification
Rewriting the workflow to call out to sub-sections
I've started experimenting with the tool bikeshed, which is the tool whatwg and a few other standards committees use for their specs. I made some slight format changes to the TUF spec in order to make bikeshed happy, which renders out here. I haven't tried playing with any more of the advanced features of bikeshed yet though, but it certainly seems like an interesting tool.
comment created time in 14 days
push eventerickt/specification
commit sha df24d0852cf66ec2243cc2deae996e5c27069361
change headers
push time in 14 days
Pull request review commentgoogle/argh
Expose HelpMessage and allow for custom help switches
impl<T: SubCommand> SubCommands for T { const COMMANDS: &'static [&'static CommandInfo] = &[T::COMMAND]; } +/// A `HelpMessage` implementation that provides a help/usage message corresponding+/// to the type's `FromArgs` implementation.+pub trait HelpMessage: FromArgs {
Why an additional trait instead of adding a method to FromArgs?
comment created time in 15 days
pull request commentgoogle/argh
Use command base name not full path.
@mboetger would you be able to add some tests for this?
comment created time in 15 days
Pull request review commentgoogle/argh
Expose HelpMessage and allow for custom help switches
pub struct TypeAttrs { pub is_subcommand: Option<syn::Ident>, pub name: Option<syn::LitStr>, pub description: Option<Description>,+ pub disable_help: Option<syn::LitBool>,
Stylistically, I think flipping this to "enable_help" reads a bit better. That avoids devs having to mentally parse expressions like if !disable_help { ... }.
comment created time in 15 days