Skip to content

KeyError while trying to delegate to new role with CLI #1114

Closed

Description

@Jakeler

Description of issue:
I am trying to out the CLI examples, but could not get delegations to work with repo.py. Running exactly these commands:

Step (1)
$ repo.py --init

Step (2)
$ repo.py --key ed25519 --filename mykey
$ repo.py --delegate "README.*" --delegatee myrole --pubkeys tufkeystore/mykey.pub
$ repo.py --sign tufkeystore/mykey --role myrole

Current behavior:
Works without errors, up to the sign command, which throws:

Traceback (most recent call last):
  File "venv/bin/repo.py", line 1141, in <module>
    process_command_line_arguments(arguments)
  File "venv/bin/repo.py", line 260, in process_command_line_arguments
    sign_role(parsed_arguments)
  File "venv/bin/repo.py", line 587, in sign_role
    repository = repo_tool.load_repository(
  File "venv/lib/python3.8/site-packages/tuf/repository_tool.py", line 3133, in load_repository
    metadata_path = delegated_roles_filenames[rolename]
KeyError: 'myrole'

The new role is added to the target.json and also snapshot and timestamp updated, but there is no myrole.json created from the delegate command. This problem surfaces at the last command, it tries to load the repo again (for signing) and fails because it can not find metadata for the delegated role... After that all commands immediately fail at loading the repo.

Expected behavior:
That it creates a myrole.json and signs it with mykey.

Additional info:
I have also gone through the Advanced Tutorial and this works fine (creates the role metadata) running the functions from repository_tool.py directly.

Looking through the code I am not sure how it is intended to work with repo.py. Should the sign step create the missing role metadata instead? So signing before adding the delegation? But that does not work either:

$ repo.py --sign tufkeystore/mykey --role newrole
Error: Key: <ID HEX>

Activity

  1. lukpueh commented on Aug 21, 2020

    @lukpueh
    Member

    Thanks for reporting the issue, @Jakeler! I'm adding this to the collection of known cli tool issues: #881

  2. jku commented on Feb 16, 2022

    @jku
    Member

    Closing this issue as it was filed against (what is now known as) the legacy codebase: issue seems to not be relevant anymore. Please re-open or file a new issue if you feel that the issue is revelant to current python-tuf.

    Note that we do not provide a repository CLI tool at the moment: examples/repo_example shows how to implement repository workflows with current codebase.

    More details

    Current source code (and upcoming 1.0 release) only contains the modern components

    • a low-level Metadata API (tuf.api) and
    • tuf.ngclient that implements the client workflow,

    Legacy components (e.g. tuf.client, tuf.repository_tool, tuf.repository_lib as well as the repo and client scripts) are no longer included. See announcement and API reference for more details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions