Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Fix root self verification to only count a keyid once towards the threshold #1218

Merged
merged 2 commits into from
Nov 24, 2020
Merged

Fix root self verification to only count a keyid once towards the threshold #1218

merged 2 commits into from
Nov 24, 2020

Commits on Nov 24, 2020

  1. tests: test that new root sigs only count once 

    When the updater is verifying that the new root metadata is signed by a
threshold of keys defined by the new root metadata itself, multiple
signatures with the same keyid should not be counted more than once
towards the threshold.

Implement a test for this, which currently fails.

Reported-by: Trishank Karthik Kuppusamy <trishank.kuppusamy@datadoghq.com>
Signed-off-by: Joshua Lock <jlock@vmware.com>
    @joshuagl
    joshuagl committed Nov 24, 2020
    Configuration menu
    Copy the full SHA
    71cb004 View commit details
    Browse the repository at this point in the history

  2. client: new root sigs only counted once per keyid 

    When verifying newly downloaded root metadata with the keys listed in the
root metadata being verified, multiple signatures with the same keyid
should not be counted towards the threshold. A keyid should only count
once towards the threshold.

This fixes the _verify_root_self_signed() method introduced in PR theupdateframework#1101 to
ensure that keyids are only counted once when verifying a threshold of new
root signatures.

Signed-off-by: Joshua Lock <jlock@vmware.com>
    @joshuagl
    joshuagl committed Nov 24, 2020
    Configuration menu
    Copy the full SHA
    83ac7be View commit details
    Browse the repository at this point in the history