Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Misleading / missing steps in TUTORIAL for delegated roles #838

Closed
awwad opened this issue Mar 25, 2019 · 4 comments
Closed

Misleading / missing steps in TUTORIAL for delegated roles #838

awwad opened this issue Mar 25, 2019 · 4 comments
Labels
documentation Documentation of the project as well as procedural documentation good first issue Bite-sized items for first time contributors repository Related to the repository implementation up for grabs

Comments

@awwad
Copy link
Contributor

awwad commented Mar 25, 2019

There are a few issues here:

  1. The output if you try to delegate to a delegated role can include two warnings that may be misleading, as it is not made clear in standard out that they are warnings:

    •   logger.warning(repr(target_filepath) + ' is not located in the'
       ' repository\'s targets directory: ' + repr(self._targets_directory))
      
    • A warning that indicates that the verification keys have "already been used" if they are already in the keydb for any reason (which does not require that another role already has used them).
  2. The tutorial doesn't tell you how to deal with writing delegated roles, which requires that you mark the role (and timestamp and snapshot at least) as dirty, every time.

@awwad awwad added documentation Documentation of the project as well as procedural documentation good first issue Bite-sized items for first time contributors repository Related to the repository implementation up for grabs labels Mar 25, 2019
@joshuagl
Copy link
Member

Two parts of this issue have been addressed:

However one item remains, a warning that indicates that the verification keys have "already been used" is still emitted. I don't think warning is the right log level for this. In what scenarios is the message useful? Could the logged message be clearer about what the impact is?

@lukpueh
Copy link
Member

lukpueh commented May 28, 2020

I can only guess, but I would say the original intention was to prevent someone from re-using the same key for different roles, which is a legitimate motivation. But as @awwad indicates above, the warning does not check for key re-use among roles, it just checks if the key, detached from any role, is already in the keydb (a global dictionary associated with a repository).

My assessment:

  • The warning as it is right now IS NOT useful and just spams the user
  • A warning that reliably informs the user about a key re-use, and it's perils WOULD BE useful
  • This is a low priority issue, and I suggest we provide a proper fix in the course of a larger refactor.
  • That said, I'm happy to merge a quickfix that decreases the log level, e.g. to INFO and/or changes the message to something more truthful.

@lukpueh
Copy link
Member

lukpueh commented May 28, 2020

Btw. thanks for updating the status of this issue, @joshuagl!

@joshuagl joshuagl added this to the Refactor milestone Jul 7, 2020
@joshuagl joshuagl removed this from the Refactor milestone Sep 8, 2020
@jku
Copy link
Member

jku commented Feb 16, 2022

Closing this issue as it was filed against (what is now known as) the legacy codebase: issue seems to not be relevant anymore. Please re-open or file a new issue if you feel that the issue is revelant to current python-tuf.

TUTORIAL is no longer, we have examples in examples/ directory though.

More details

Current source code (and upcoming 1.0 release) only contains the modern components

  • a low-level Metadata API (tuf.api) and
  • tuf.ngclient that implements the client workflow,

Legacy components (e.g. tuf.client, tuf.repository_tool, tuf.repository_lib as well as the repo and client scripts) are no longer included. See announcement and API reference for more details.

@jku jku closed this as completed Feb 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Documentation of the project as well as procedural documentation good first issue Bite-sized items for first time contributors repository Related to the repository implementation up for grabs
Projects
None yet
Development

No branches or pull requests

4 participants