ngclient: test fast-forward recovery

I think we do not currently test successful rollback (aka fast-forward recovery) for timestamp, snapshot and targets:

simulate a fast-forward attack: create repository with valid timestamp/snapshot/targets with version=MAX_VERSION (or something large anyway)
update client so it sees the large versions
rotate the affected key (timestamp or snapshot) and set metadata version=1
update client, assert that new metadata is accepted by ngclient (even though the version number is lower than the local version)

Please, can you sign this issue for me?

create repository with valid timestamp/snapshot/targets with version=MAX_VERSION

I'm not sure if there even is a practical MAX_VERSION in our implementation -- python seems to seamlessly upgrade from an int to some big int implementation... I think this is not relevant anyway: the point is that version is something large that we want to reinitialize to 1.

I think we're done here! Thanks Kairo

Navigation Menu

Repository navigation

ngclient: test fast-forward recovery #1713

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ngclient: test fast-forward recovery #1713

Description

Activity

kairoaraujo commented on Dec 8, 2021

jku commented on Dec 15, 2021

jku commented on Jan 11, 2022

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions