Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Transition to the newest version of TUF #561

Open
wants to merge 102 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
102 commits
Select commit Hold shift + click to select a range
60b8fa9
Update tuf, securesystemslib and cryptography deps
lukpueh Aug 23, 2024
f62907e
Add alternative TUF metadata repo implementation
lukpueh Aug 23, 2024
ad2b58f
Change create and add_keys API to take signers
lukpueh Aug 26, 2024
b46645b
Make sure targets is signed on add key
lukpueh Aug 26, 2024
33750eb
Assert keytype rsa in taf.tuf.keys helper
lukpueh Aug 27, 2024
42fbfac
Add signer implementation for Yubikeys
lukpueh Aug 28, 2024
25371d7
Comment out legacy imports (WIP)
lukpueh Aug 28, 2024
ec294a8
Merge branch 'feature/tuf-repositoty' into tuf-upgrade
renatav Oct 29, 2024
70927b7
Merge pull request #512 from lukpueh/tuf-upgrade
renatav Oct 29, 2024
9bf3fb9
feat: moved get threshold to the new repository class, implement dele…
renatav Oct 29, 2024
c7be3cb
refact: move get expiration date, get all targets and check expiratio…
renatav Oct 30, 2024
7601b9b
refact: move get role paths and all target files to the new repositor…
renatav Oct 30, 2024
b8d247e
refact: work on making the create repository method more flexible
renatav Oct 31, 2024
ade9af1
refact: extend creation of repositories using the new TUF, added supp…
renatav Oct 31, 2024
f1c1b6c
test: add create repository with delegations test
renatav Nov 1, 2024
ea05769
test: use repository created using create in tests
renatav Nov 1, 2024
c9857d0
test, refact: reorganize tests, implement keyid-roles mapping using t…
renatav Nov 1, 2024
b7eb34a
test: re-enabled add target test
renatav Nov 2, 2024
ccb94b8
refact: moved modify targets to the new repository class
renatav Nov 4, 2024
43af588
test: create test repos with target files and custom data
renatav Nov 5, 2024
feb7b53
refac, test: move get_all_target_files_state to the new repository cl…
renatav Nov 5, 2024
3202900
refact: move generate_roles_description to the new repository class
renatav Nov 5, 2024
af59138
test, refact: minor tests refactoring, reimplement is_valid_metadata_key
renatav Nov 6, 2024
51d63c9
refact: test: reimplement add metadata keys, enable keys tests
renatav Nov 6, 2024
e57b8e3
feat, test: implement revoke key
renatav Nov 7, 2024
abeaa2c
test, fix: minor add and revoke key improvements
renatav Nov 7, 2024
f3bc1f7
refact, test: initial work on reworking signing, add set expiration d…
renatav Nov 8, 2024
2681d4a
refact: remeve outdated imports
renatav Nov 8, 2024
0d67dd5
refact: check and set expiration date reimplemented
renatav Nov 8, 2024
ba7d3eb
refact: update key generation
renatav Nov 8, 2024
ea93127
refact: reimplement repository_at_revision
renatav Nov 9, 2024
4122100
refact: update updater and the creation of a new repository
renatav Nov 9, 2024
e21edfd
fix: bare repositories fix
renatav Nov 9, 2024
d9e5cc0
refact: reimplement addition of verification keys when creating a new…
renatav Nov 11, 2024
67fbc2b
fix: minor create repo fix
renatav Nov 11, 2024
c1cd853
refact: remove do_snapshot and timestamp from add/revoke keys
renatav Nov 11, 2024
7fe4d2f
refact: work on initializing repository and signers in api
renatav Nov 14, 2024
e77210b
fix, feat: fix add keys, add revoke key command
renatav Nov 14, 2024
947f1e4
test: add add delegated paths test
renatav Nov 14, 2024
5c56ede
refact: rework create new role
renatav Nov 15, 2024
c92c39b
refact: support adding multiple new roles
renatav Nov 15, 2024
f63a058
refact, fix: fix create delagations when no previouis delgations, rew…
renatav Nov 15, 2024
66a2742
refact: refactored remove paths
renatav Nov 16, 2024
2fe6d72
fix: minor fixes, update update-expiration-dates
renatav Nov 16, 2024
5ddb0c3
refact, test: remove unused code, remove paths test added
renatav Nov 16, 2024
dfbcde6
refact: rework targets update
renatav Nov 16, 2024
c541df8
test: add update targets roles test
renatav Nov 18, 2024
45c8c02
refact: reimplement add target repo
renatav Nov 19, 2024
4917b71
refact: rework remove target repo
renatav Nov 19, 2024
2f817d3
refact: update add/remove dependencies
renatav Nov 19, 2024
de7f5f8
test, refact: refact repository init tests, remove outdated tests
renatav Nov 19, 2024
96c7df1
test: work on refactoring test_create_repository tests
renatav Nov 20, 2024
7a787f4
test, refact: reorganize conftest
renatav Nov 20, 2024
1b7146b
test: rework test dependencies, metadata and roles api tests
renatav Nov 21, 2024
c5de6e1
chore: remove ramaining test repos
renatav Nov 21, 2024
739c014
test: refact test targets
renatav Nov 21, 2024
4fd29db
test, refact: update repositoriesdb tests, some refactoring, remove u…
renatav Nov 21, 2024
fbc0a8a
fix: fix snapshot info length/hash issue
renatav Nov 22, 2024
68fb96e
feat: initial implementation of git storage backed, which can load me…
renatav Nov 22, 2024
84a52f2
fix: bypass storage singleton
renatav Nov 22, 2024
8224179
fix: update root version number when updating snaphost. Work on updat…
renatav Nov 25, 2024
5afeaf5
test: update test_update_invalid
renatav Nov 26, 2024
6573a6a
fix: fix update expiration dates. Snapshot info was not getting updated
renatav Nov 27, 2024
959ab49
test: update remaining updater tests, minor cleanup
renatav Nov 27, 2024
16abe0c
chore: cleanup, formatting, remove unused code and imports
renatav Nov 27, 2024
4f02ce1
chore: bump yubikey-manager version
renatav Nov 27, 2024
62a8cac
chore: fixing mypy issues
renatav Nov 27, 2024
cb5b45a
chore: import and mypy issues
renatav Nov 27, 2024
2070426
chore: mypy issues
renatav Nov 27, 2024
106836c
chore: remove unused import
renatav Nov 27, 2024
896eb73
chore: comment out yubukey tests
renatav Nov 27, 2024
f262d81
test: remove generation of tests
renatav Nov 27, 2024
324e642
chore: formatting
renatav Nov 27, 2024
ea6dbf2
test: fix a number of failing tests
renatav Nov 28, 2024
32b2930
chore: remove unused import
renatav Nov 28, 2024
b37a631
test: rework keys tests
renatav Nov 28, 2024
d3d7263
test: update number of root keys in updater keys description
renatav Nov 29, 2024
3000095
fix: fix failing tests
renatav Nov 29, 2024
65c128b
refact: update yubikey cli functions
renatav Nov 29, 2024
4805128
test: refact yubikey tests
renatav Nov 30, 2024
789b591
refact: refactor creation of repositories using yubikeys
renatav Nov 30, 2024
ff146df
chore: formatting and mypy fixes
renatav Nov 30, 2024
e402196
test: add pytest-mock to test requirements
renatav Nov 30, 2024
de1bd82
Merge branch 'master' into feature/tuf-repositoty
renatav Nov 30, 2024
da5344d
chore: update changelog
renatav Nov 30, 2024
2f16959
chore: merge master
renatav Nov 30, 2024
f22da80
test: tun tests without having ykman installed
renatav Dec 4, 2024
7db3588
chore: ignore unused import
renatav Dec 4, 2024
6410f52
docs: GitStorageBackend docstring
renatav Dec 4, 2024
4ab8c48
feat: add a command for rotating keys
renatav Dec 9, 2024
dc431c5
test: add test revoke signing key test
renatav Dec 9, 2024
5ea21e7
docs: update docs related to repository classes
renatav Dec 10, 2024
bef7f8e
chore: merge master and resolve conflicts
renatav Dec 13, 2024
4490e9b
docs: add/update a number of metadata repository docstrings
renatav Dec 19, 2024
81e0799
docs: add docstrings to metadata repository
renatav Dec 19, 2024
78a91b5
docs: update docstrings, comments and docs
renatav Dec 20, 2024
cc45f38
chore: mypy and formatting fixes
renatav Dec 21, 2024
22dd4b8
refact: update validation.py imports
renatav Dec 21, 2024
8b20832
feat: introduce cli tests with click `CliRunner`
n-dusan Dec 21, 2024
005b293
test: fix failing cli tests
renatav Dec 24, 2024
6f79d2b
chore: merge master and resolve conflicts
renatav Dec 24, 2024
f496fe9
chore: formatting
renatav Dec 24, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 0 additions & 51 deletions taf/repository_tool.py
Original file line number Diff line number Diff line change
Expand Up @@ -183,13 +183,6 @@ def __init__(self, path, name="default"):

_framework_files = ["repositories.json", "test-auth-repo"]

@property
def targets_path(self):
return self.path / TARGETS_DIRECTORY_NAME

@property
def metadata_path(self):
return self.path / METADATA_DIRECTORY_NAME

_tuf_repository = None

Expand Down Expand Up @@ -384,13 +377,6 @@ def add_existing_target(self, file_path, targets_role="targets", custom=None):
targets_obj = self._role_obj(targets_role)
self._add_target(targets_obj, file_path, custom)

def get_all_roles(self):
"""
Return a list of all defined roles, main roles combined with delegated targets roles
"""
all_target_roles = self.get_all_targets_roles()
all_roles = ["root", "targets", "snapshot", "timestamp"] + all_target_roles
return all_roles

def get_all_target_files_state(self):
"""Create dictionaries of added/modified and removed files by comparing current
Expand Down Expand Up @@ -548,24 +534,6 @@ def modify_targets(self, added_data=None, removed_data=None):

return targets_role

def all_target_files(self):
"""
Return a set of relative paths of all files inside the targets
directory
"""
targets = []
for root, _, filenames in os.walk(str(self.targets_path)):
for filename in filenames:
filepath = Path(root) / filename
if filepath.is_file():
targets.append(
str(
Path(
os.path.relpath(str(filepath), str(self.targets_path))
).as_posix()
)
)
return set(targets)

def get_target_file_custom_data(self, target_path):
"""
Expand Down Expand Up @@ -821,25 +789,6 @@ def get_role_keys(self, role, parent_role=None):
pass
return self.get_delegated_role_property("keyids", role, parent_role)

def get_role_paths(self, role, parent_role=None):
"""Get paths of the given role

Args:
- role(str): TUF role (root, targets, timestamp, snapshot or delegated one)
- parent_role(str): Name of the parent role of the delegated role. If not specified,
it will be set automatically, but this might be slow if there
are many delegations.

Returns:
Defined delegated paths of delegate target role or * in case of targets

Raises:
- securesystemslib.exceptions.FormatError: If the arguments are improperly formatted.
- securesystemslib.exceptions.UnknownRoleError: If 'rolename' has not been delegated by this
"""
if role == "targets":
return "*"
return self.get_delegated_role_property("paths", role, parent_role)

def get_role_repositories(self, role, parent_role=None):
"""Get repositories of the given role
Expand Down
31 changes: 28 additions & 3 deletions taf/tests/test_repository/test_repo.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,28 +30,35 @@ def test_get_expiration_date():
assert tuf_repo.get_expiration_date("delegated_role1") == datetime.datetime(2020, 2, 5, 18, 14, 2, tzinfo=datetime.timezone.utc)


def test_get_all_roles_no_delegations():
def test_get_all_target_roles_no_delegations():
test_group_dir = TEST_DATA_REPOS_PATH / "test-repository-tool/test-happy-path-pkcs1v15" / "taf"
tuf_repo = MetadataRepository(test_group_dir)
assert tuf_repo.get_all_targets_roles() == ["targets"]


def test_get_all_roles_with_delegations():
def test_get_all_target_roles_with_delegations():
test_group_dir = TEST_DATA_REPOS_PATH / "test-repository-tool/test-delegated-roles-pkcs1v15" / "taf"
tuf_repo = MetadataRepository(test_group_dir)
actual = tuf_repo.get_all_targets_roles()
assert len(actual) == 4
assert set(actual) == {"targets", "delegated_role1", "delegated_role2", "inner_delegated_role"}


def test_get_all_roles_with_delegations():
test_group_dir = TEST_DATA_REPOS_PATH / "test-repository-tool/test-delegated-roles-pkcs1v15" / "taf"
tuf_repo = MetadataRepository(test_group_dir)
actual = tuf_repo.get_all_roles()
assert len(actual) == 7
assert set(actual) == {"root", "snapshot", "timestamp", "targets", "delegated_role1", "delegated_role2", "inner_delegated_role"}

def test_find_delegated_roles_parent():
test_group_dir = TEST_DATA_REPOS_PATH / "test-repository-tool/test-delegated-roles-pkcs1v15" / "taf"
tuf_repo = MetadataRepository(test_group_dir)
assert tuf_repo.find_delegated_roles_parent("delegated_role1") == "targets"
assert tuf_repo.find_delegated_roles_parent("delegated_role2") == "targets"
assert tuf_repo.find_delegated_roles_parent("inner_delegated_role") == "delegated_role2"

def test_chec_if_role_exists():
def test_check_if_role_exists():
test_group_dir = TEST_DATA_REPOS_PATH / "test-repository-tool/test-delegated-roles-pkcs1v15" / "taf"
tuf_repo = MetadataRepository(test_group_dir)
assert tuf_repo.check_if_role_exists("targets")
Expand All @@ -67,3 +74,21 @@ def test_check_roles_expiration_dates():
assert "targets" in expired_dict
assert "delegated_role1" in expired_dict
assert not len(will_expire_dict)

def test_all_target_files():
test_group_dir = TEST_DATA_REPOS_PATH / "test-repository-tool/test-happy-path-pkcs1v15" / "taf"
tuf_repo = MetadataRepository(test_group_dir)
actual = tuf_repo.all_target_files()
assert len(actual) == 3
assert actual == {'branch', 'dummy/target_dummy_repo', 'repositories.json'}

def test_get_role_paths():
test_group_dir = TEST_DATA_REPOS_PATH / "test-repository-tool/test-delegated-roles-pkcs1v15" / "taf"
tuf_repo = MetadataRepository(test_group_dir)
actual = tuf_repo.get_role_paths("delegated_role1")
assert actual == ["dir1/*"]
actual = tuf_repo.get_role_paths("delegated_role2")
assert actual == ["dir2/*"]
actual = tuf_repo.get_role_paths("inner_delegated_role")
assert actual == ["dir2/inner_delegated_role.txt"]

57 changes: 56 additions & 1 deletion taf/tuf/repository.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,15 @@
Targets,
TargetFile,
Timestamp,
DelegatedRole,
)
from taf.exceptions import TAFError
from tuf.repository import Repository

logger = logging.getLogger(__name__)

METADATA_DIRECTORY_NAME = "metadata"
TARGETS_DIRECTORY_NAME = "targets"

MAIN_ROLES = ["root", "targets", "snapshot", "timestamp"]

Expand Down Expand Up @@ -59,6 +61,10 @@ def __init__(self, path: Path) -> None:
def metadata_path(self) -> Path:
return self._path / METADATA_DIRECTORY_NAME

@property
def targets_path(self):
return self._path / TARGETS_DIRECTORY_NAME

@property
def targets_infos(self) -> Dict[str, MetaFile]:
# tracks targets and root metadata changes, needed in `do_snapshot`
Expand All @@ -69,6 +75,24 @@ def snapshot_info(self) -> MetaFile:
# tracks snapshot metadata changes, needed in `do_timestamp`
return self._snapshot_info


def all_target_files(self):
"""
Return a set of relative paths of all files inside the targets
directory
"""
targets = []
# Assume self.targets_path is a Path object, or convert it if necessary
base_path = Path(self.targets_path)

for filepath in base_path.rglob('*'):
if filepath.is_file():
# Get the relative path to the base directory and convert it to a POSIX path
relative_path = filepath.relative_to(base_path).as_posix()
targets.append(relative_path)

return set(targets)

def add_target_files(self, target_files: List[TargetFile]) -> None:
"""Add target files to top-level targets metadata."""
with self.edit_targets() as targets:
Expand Down Expand Up @@ -206,6 +230,7 @@ def create(self, signers: Dict[str, Dict[str, Signer]]):
signed.version = 0 # `close` will bump to initial valid verison 1
self.close(signed.type, Metadata(signed))


def find_delegated_roles_parent(self, delegated_role, parent=None):
if parent is None:
parent = "targets"
Expand Down Expand Up @@ -254,11 +279,20 @@ def _role_obj(self, role, parent=None):
for delegation in delegations_data:
if delegation["name"] == role:
try:
return Role.from_dict(delegation)
return DelegatedRole.from_dict(delegation)
except (KeyError, ValueError):
raise TAFError(f"{delegation}.json is invalid")
return None


def get_all_roles(self):
"""
Return a list of all defined roles, main roles combined with delegated targets roles
"""
all_target_roles = self.get_all_targets_roles()
all_roles = ["root", "snapshot", "timestamp"] + all_target_roles
return all_roles

def get_all_targets_roles(self):
"""
Return a list containing names of all target roles
Expand Down Expand Up @@ -301,7 +335,28 @@ def get_role_threshold(self, role: str, parent: Optional[str]=None ) -> int:
raise TAFError(f"Role {role} does not exist")
return role_obj.threshold

def get_role_paths(self, role, parent_role=None):
"""Get paths of the given role
Args:
- role(str): TUF role (root, targets, timestamp, snapshot or delegated one)
- parent_role(str): Name of the parent role of the delegated role. If not specified,
it will be set automatically, but this might be slow if there
are many delegations.
Returns:
Defined delegated paths of delegate target role or * in case of targets
n-dusan marked this conversation as resolved.
Show resolved Hide resolved
Raises:
- securesystemslib.exceptions.FormatError: If the arguments are improperly formatted.
- securesystemslib.exceptions.UnknownRoleError: If 'rolename' has not been delegated by this
"""
if role == "targets":
return "*"
role = self._role_obj(role)
if role is None:
raise TAFError(f"Role {role} does not exist")
return role.paths

def set_metadata_expiration_date(self, role, start_date=None, interval=None):
"""Set expiration date of the provided role.
Expand Down
Loading