Identify components of client and determine how to split out client from current code base

[joshuagl]

Description of issue or feature request:

For both the pip integration, and in order to provide some semblance of support for Python 2.7 users when we proceed with the refactor (#1127), it would be very useful to have the client be installable by itself without any of the modules which are only used for a repository.

We should identify what pieces of the current code are required by the client. Can we create a branch with only the client and its dependencies? Can we adapt the current client tests to work without tuf.repository_lib and tuf.repository_tool?

The tuf updater requires at least the following modules:

• tuf.client.updater
• tuf.download
• tuf.mirrors
• tuf.sig
• tuf.formats
• tuf.settings
• tuf.keydb
• tuf.roledb
• tuf.exceptions

Current behavior:

Client and repository code is installed as one big package

Expected behavior:

Possible to install only the client, without any modules used only by a repository

[sechkova]

I can try and help here, starting with a client branch with a couple of tests only and we can progress gradually.

Tests use repository_tool and repository_lib mostly to load, sign and write metadata. It seems possible to replace these calls by doing the file operations "manually" and calling directly securesystemslib.

One question is which tests should be considered client-only? Besides the obvious test_updater, the tests that import the updater module are:

test_arbitrary_package_attack.py
test_endless_data_attack.py
test_extraneous_dependencies_attack.py
test_indefinite_freeze_attack.py
test_key_revocation_integration.py
test_mix_and_match_attack.py
test_multiple_repositories_integration.py
test_replay_attack.py
test_slow_retrieval_attack.py
test_updater_new.py
test_updater.py
test_updater_root_rotation_integration.py

Should we keep one client-only version of these tests as well as one repository version or depending on the context and type of the simulated attack we can assign them to one of the two?

I kept the hard question for the end ... naming? tuf-client?

[lukpueh]

I kept the hard question for the end ... naming? tuf-client?

Hard question indeed, although in this case tuf-client seems like the obvious choice.

[jku]

I think we have our answer now: metadata API + ngclient is the minimal set. Splitting out is likely not necessary but separate packaging would be possible