More flexible file hashing support #991
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Using securesystemslib.settings.HASH_ALGORITHMS is undersirable, because it binds tuf to an implementation detail of the underlying library. In this specific instance of file hashing algorithms it's even more undesirable because it's overloading the intended use of the setting which is "algorithm(s) [...] used to generate key IDs". Add a new setting tuf.settings.FILE_HASH_ALGORITHMS, with a default value of ['sha256', 'sha512'] (that matches the current value of securesystemslib.settings.HASH_ALGORITHMS), to be used for file hashing operations in tuf. Signed-off-by: Joshua Lock <[email protected]>
Timestamp.json includes a METAFILES entry for snapshot.json. METAFILES
includes HASHES:
"HASHES is the dictionary that specifies one or more hashes, including the
cryptographic hash function. For example: { "sha256": HASH, ... }."
We've been hard-coding this to a single sha256 hash, as that's the default
algorithms argument of securesystemlib.util.get_file_details() -- this
feels wrong. Change to using the new tuf.settings.FILE_HASH_ALGORITHMS
setting.
Signed-off-by: Joshua Lock <[email protected]>
joshuagl
commented
Mar 5, 2020
| @@ -1531,7 +1531,8 @@ def generate_timestamp_metadata(snapshot_filename, version, expiration_date, | |||
|
|
|||
| # Retrieve the versioninfo of the Snapshot metadata file. | |||
| snapshot_fileinfo = {} | |||
| length, hashes = securesystemslib.util.get_file_details(snapshot_filename) | |||
| length, hashes = securesystemslib.util.get_file_details(snapshot_filename, | |||
| tuf.settings.FILE_HASH_ALGORITHMS) | |||
There was a problem hiding this comment.
I couldn't see any reason in the spec not to use the same hashing algorithms here as we do in targets?
There was a problem hiding this comment.
That's my reading as well. The more consistency in algorithm selection between roles the better, IMO.
|
I'm closing this pull request because I don't want the branch name 'dirtyhack' to live in perpetuity in the merge commit. This didn't end up being such a dirty hack after-all. |
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please fill in the fields below to submit a pull request. The more information
that is provided, the better.
Fixes issue #:
Description of the changes being introduced by the pull request:
Please verify and check that the pull request fulfills the following
requirements: