go-tuf requires snapshot.json length/hashes to be set in timestamp meta

[znewman01]

In #228, I discovered that python-tuf can generate metadata that fails update in go-tuf. In particular, timestamp.json is:

{
 "signatures": [
  {
   "keyid": "941da208a0a7547b698585b6c6f04b72280644f0cddfe27a3acfd2ca683cc7a4",
   "sig": "810f1b6cba5dd8a3fea906ed5956c4f984de6e1979a11abaa8de7d2c539e105abcce7e51589219da8a97a4c6138360c7921d65b1ac8d46f75b0d287bab064f06"
  }
 ],
 "signed": {
  "_type": "timestamp",
  "expires": "2030-01-01T00:00:00Z",
  "meta": {
   "snapshot.json": {
    "version": 1
   }
  },
  "spec_version": "1.0.19",
  "version": 1
 }
}

Calling client.Update() gives:

python_interop_test.go:67:
    c.Assert(err, IsNil)
... value client.ErrDownloadFailed = client.ErrDownloadFailed{File:"snapshot.json", Err:util.ErrWrongLength{Expected:0, Actual:432}} ("tuf: failed to download snapshot.json: wrong length, expected 0 got 432")

(The snapshot meta does allow missing length/hashes.)

These fields are listed as OPTIONAL for snapshot metadata, and the spec for timestamp metadata reads:

METAFILES is the same as described for the snapshot.json file. In the case of the timestamp.json file, this MUST only include a description of the snapshot.json file.

[trishankatdatadog]

Yes, I'm afraid there's been an update to the spec since the relevant go-tuf code was written 😕 Thanks for the report!

[joshuagl]

This behaviour was changed in ed6788e. TimestampFileMetaEqual() now only checks the length and hashes when they are not nil.