Unable to initialize client without fetching from remote #208
Comments
haydentherapper
added a commit
to haydentherapper/go-tuf
that referenced
this issue
Jan 25, 2022
This will allow users of go-tuf to initialize a client without requiring a remote connection. This is useful for when a root has been updated and the local root verification keys can no longer verify the the latest remote root, except by verifying the chain with client.Update(). Ref theupdateframework#208 Signed-off-by: Hayden Blauzvern <[email protected]>
haydentherapper
added a commit
to haydentherapper/go-tuf
that referenced
this issue
Feb 10, 2022
This will allow users of go-tuf to initialize a client without requiring a remote connection. This is useful for when a root has been updated and the local root verification keys can no longer verify the the latest remote root, except by verifying the chain with client.Update(). Ref theupdateframework#208 Signed-off-by: Hayden Blauzvern <[email protected]>
haydentherapper
added a commit
to haydentherapper/go-tuf
that referenced
this issue
Feb 10, 2022
This will allow users of go-tuf to initialize a client without requiring a remote connection. This is useful for when a root has been updated and the local root verification keys can no longer verify the the latest remote root, except by verifying the chain with client.Update(). Ref theupdateframework#208 Signed-off-by: Hayden Blauzvern <[email protected]>
haydentherapper
added a commit
to haydentherapper/go-tuf
that referenced
this issue
Feb 10, 2022
This will allow users of go-tuf to initialize a client without requiring a remote connection. This is useful for when a root has been updated and the local root verification keys can no longer verify the the latest remote root, except by verifying the chain with client.Update(). Ref theupdateframework#208 Signed-off-by: Hayden Blauzvern <[email protected]>
|
Until a versioned release process is in place, I've added a second method |
asraa
pushed a commit
that referenced
this issue
Feb 10, 2022
* Add client method for initializing from root metadata This will allow users of go-tuf to initialize a client without requiring a remote connection. This is useful for when a root has been updated and the local root verification keys can no longer verify the the latest remote root, except by verifying the chain with client.Update(). Ref #208 Signed-off-by: Hayden Blauzvern <[email protected]> * Prefer InitLocal over Init in client and tests Signed-off-by: Hayden Blauzvern <[email protected]>
|
Scheduling deprecation for v0.4 |
2 tasks
znewman01
moved this from 🆕 New
to 🏗 In progress
in [go-tuf] Project planning - v0.6.0 (Target: 2022-11-30)
znewman01
moved this from 🏗 In progress
to 👀 In review
in [go-tuf] Project planning - v0.6.0 (Target: 2022-11-30)
znewman01
added a commit
to znewman01/go-tuf
that referenced
this issue
Aug 5, 2022
Straightforward find/replace:
find . -name '*.go' | xargs sed -i 's/InitLocal/Init/g'
BREAKING CHANGE: the method signature of `Init()` has changed since the
last release to take in the raw `root.json` metadata.
Fixes theupdateframework#208.
Signed-off-by: Zachary Newman <[email protected]>
5 tasks
znewman01
added a commit
to znewman01/go-tuf
that referenced
this issue
Aug 5, 2022
Straightforward find/replace:
find . -name '*.go' | xargs sed -i 's/InitLocal/Init/g'
BREAKING CHANGE: the method signature of `Init()` has changed since the
last release to take in the raw `root.json` metadata.
Fixes theupdateframework#208.
Signed-off-by: Zachary Newman <[email protected]>
trishankatdatadog
pushed a commit
that referenced
this issue
Aug 5, 2022
* refactor!: rename "InitLocal" to "Init"
Straightforward find/replace:
find . -name '*.go' | xargs sed -i 's/InitLocal/Init/g'
BREAKING CHANGE: the method signature of `Init()` has changed since the
last release to take in the raw `root.json` metadata.
Fixes #208.
Signed-off-by: Zachary Newman <[email protected]>
* test: remove now-obsolete duplicate test
Signed-off-by: Zachary Newman <[email protected]>
Repository owner
moved this from 👀 In review
to ✅ Done
in [go-tuf] Project planning - v0.6.0 (Target: 2022-11-30)
Aug 5, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Before calling
client.Updateorclient.UpdateRoots, it is expected that the client has been initialized withclient.Init.Inituses a set of root keys, pulls the latestroot.json, verifies it with those keys, and saves it locally.The issue is there's no guarantee that the latest root can be verified using the set of root keys. For example, let's say a project is shipped with the first
root.json. Before a new root signing, one key is rotated. After 5 signings, all keys used to sign the remoteroot.jsonwill have been rotated.Initwill fail, and there's no other way to directly initialize the client.The proper way to initialize a client would be to initialize the client with a local root, then walk and verify the chain using
UpdateorUpdateRoots. I'd like to propose thatInittake the localroot.jsonto initialize the database, and not make any calls to the remote to fetch the latestroot.json.Another option would be for
Initto take the set of root keys and threshold, its current API, and callUpdateRootsas part of initialization. I would prefer that this not be the default, for those who don't want to initialize a client with the latest root.cc @asraa
The text was updated successfully, but these errors were encountered: