pub fn update_delegation(
        &mut self,
        parent_role: &MetadataPath,
        role: &MetadataPath,
        raw_delegation: &RawSignedMetadata<D, TargetsMetadata>,
    ) -> Result<bool> {
        let verified = {
            // FIXME(https://github.com/theupdateframework/specification/issues/113) Checking if
            // this metadata expired isn't part of the spec. Do we actually want to do this?
            let _ = self.trusted_root_unexpired()?;
            let trusted_snapshot = self.trusted_snapshot_unexpired()?;
            let trusted_targets = self.trusted_targets_unexpired()?;

            if trusted_targets.delegations().is_none() {
                return Err(Error::VerificationFailure(
                    "Delegations not authorized".into(),
                ));
            };

            let trusted_delegation_description = match trusted_snapshot.meta().get(role) {
                Some(d) => d,
                None => {
                    return Err(Error::VerificationFailure(format!(
                        "The degated role {:?} was not present in the snapshot metadata.",
                        role
                    )));
                }
            };

            let trusted_delegation_version = self.trusted_delegation_version(role);

            if trusted_delegation_description.version() < trusted_delegation_version {
                return Err(Error::VerificationFailure(format!(
                    "Snapshot metadata did listed delegation {:?} version as {} but current\
                     version is {}",
                    role,
                    trusted_delegation_description.version(),
                    trusted_delegation_version
                )));
            }

            // FIXME(#279) update_delegation trusts tuf::Client to provide too much information,
            // making this difficult to verify as correct.

            /////////////////////////////////////////
            // TUF-1.0.5 §5.4.1:
            //
            //     Check against snapshot metadata. The hashes and version number of the new
            //     targets metadata file MUST match the hashes (if any) and version number listed
            //     in the trusted snapshot metadata. This is done, in part, to prevent a
            //     mix-and-match attack by man-in-the-middle attackers. If the new targets metadata
            //     file does not match, discard it, abort the update cycle, and report the failure.

            let (threshold, keys) = self
                .find_delegation_threshold_and_keys(parent_role, role)
                .ok_or_else(|| {
                    Error::VerificationFailure(format!(
                        "The delegated role {:?} is not known to the base \
                        targets metadata or any known delegated targets metadata",
                        role
                    ))
                })?;

            let new_delegation = verify::verify_signatures(raw_delegation, threshold, keys)?;

            if trusted_delegation_version == trusted_delegation_description.version() {
                return Ok(false);
            }

            if new_delegation.version() != trusted_delegation_description.version() {
                return Err(Error::VerificationFailure(format!(
                    "The snapshot metadata reported that the delegation {:?} should be at \
                     version {} but version {} was found instead.",
                    role,
                    trusted_delegation_description.version(),
                    new_delegation.version(),
                )));
            }

            if new_delegation.expires() <= &Utc::now() {
                // TODO this needs to be chagned to accept a MetadataPath and not Role
                return Err(Error::ExpiredMetadata(Role::Targets));
            }

            new_delegation
        };

        let _ = self.trusted_delegations.insert(role.clone(), verified);

        Ok(true)
    }
/// Verify and update a delegation metadata.
Verify and update a delegation metadata.
Verify and update a delegation metadata .
pub fn update_delegation(
        &mut self,
        parent_role: &MetadataPath,
        role: &MetadataPath,
        raw_delegation: &RawSignedMetadata<D, TargetsMetadata>,
    ) -> Result<bool> {
        let verified = {
            // FIXME(https://github.com/theupdateframework/specification/issues/113) Checking if
            // this metadata expired isn't part of the spec. Do we actually want to do this?
            let _ = self.trusted_root_unexpired()?;
            let trusted_snapshot = self.trusted_snapshot_unexpired()?;
            let trusted_targets = self.trusted_targets_unexpired()?;
            if trusted_targets.delegations().is_none() {
                return Err(Error::VerificationFailure(
                    "Delegations not authorized".into(),
                ));
            };
            let trusted_delegation_description = match trusted_snapshot.meta().get(role) {
                Some(d) => d,
                None => {
                    return Err(Error::VerificationFailure(format!(
                        "The degated role {:?} was not present in the snapshot metadata.",
                        role
                    )));
                }
            };
            let trusted_delegation_version = self.trusted_delegation_version(role);
            if trusted_delegation_description.version() < trusted_delegation_version {
                return Err(Error::VerificationFailure(format!(
                    "Snapshot metadata did listed delegation {:?} version as {} but current\
                     version is {}",
                    role,
                    trusted_delegation_description.version(),
                    trusted_delegation_version
                )));
            }
            // FIXME(#279) update_delegation trusts tuf::Client to provide too much information,
            // making this difficult to verify as correct.
            /////////////////////////////////////////
            // TUF-1.0.5 §5.4.1:
            //
            //     Check against snapshot metadata. The hashes and version number of the new
            //     targets metadata file MUST match the hashes (if any) and version number listed
            //     in the trusted snapshot metadata. This is done, in part, to prevent a
            //     mix-and-match attack by man-in-the-middle attackers. If the new targets metadata
            //     file does not match, discard it, abort the update cycle, and report the failure.
            let (threshold, keys) = self
                .find_delegation_threshold_and_keys(parent_role, role)
                .ok_or_else(|| {
                    Error::VerificationFailure(format!(
                        "The delegated role {:?} is not known to the base \
                        targets metadata or any known delegated targets metadata",
                        role
                    ))
                })?;
            let new_delegation = verify::verify_signatures(raw_delegation, threshold, keys)?;
            if trusted_delegation_version == trusted_delegation_description.version() {
                return Ok(false);
            }
            if new_delegation.version() != trusted_delegation_description.version() {
                return Err(Error::VerificationFailure(format!(
                    "The snapshot metadata reported that the delegation {:?} should be at \
                     version {} but version {} was found instead.",
                    role,
                    trusted_delegation_description.version(),
                    new_delegation.version(),
                )));
            }
            if new_delegation.expires() <= &Utc::now() {
                // TODO this needs to be chagned to accept a MetadataPath and not Role
                return Err(Error::ExpiredMetadata(Role::Targets));
            }
            new_delegation
        };
        let _ = self.trusted_delegations.insert(role.clone(), verified);
        Ok(true)
    }
pub fn update_delegation ( & mut self , parent_role : & MetadataPath , role : & MetadataPath , raw_delegation : & RawSignedMetadata < D , TargetsMetadata > , ) -> Result < bool > { let verified = { // FIXME(https://github.com/theupdateframework/specification/issues/113) Checking if // this metadata expired isn't part of the spec. Do we actually want to do this? let _ = self . trusted_root_unexpired ( ) ? ; let trusted_snapshot = self . trusted_snapshot_unexpired ( ) ? ; let trusted_targets = self . trusted_targets_unexpired ( ) ? ; if trusted_targets . delegations ( ) . is_none ( ) { return Err ( Error :: VerificationFailure ( " " . into ( ) , ) ) ; } ; let trusted_delegation_description = match trusted_snapshot . meta ( ) . get ( role ) { Some ( d ) => d , None => { return Err ( Error :: VerificationFailure ( format ! ( " " role ) ) ) ; } } ; let trusted_delegation_version = self . trusted_delegation_version ( role ) ; if trusted_delegation_description . version ( ) < trusted_delegation_version { return Err ( Error :: VerificationFailure ( format ! ( " \
 " role trusted_delegation_description version ( ) trusted_delegation_version ) ) ) ; } // FIXME(#279) update_delegation trusts tuf::Client to provide too much information, // making this difficult to verify as correct. ///////////////////////////////////////// // TUF-1.0.5 §5.4.1: // //     Check against snapshot metadata. The hashes and version number of the new //     targets metadata file MUST match the hashes (if any) and version number listed //     in the trusted snapshot metadata. This is done, in part, to prevent a //     mix-and-match attack by man-in-the-middle attackers. If the new targets metadata //     file does not match, discard it, abort the update cycle, and report the failure. let ( threshold , keys ) = self . find_delegation_threshold_and_keys ( parent_role , role ) . ok_or_else ( | | { Error :: VerificationFailure ( format ! ( " \
 " role ) ) } ) ? ; let new_delegation = verify :: verify_signatures ( raw_delegation , threshold , keys ) ? ; if trusted_delegation_version == trusted_delegation_description . version ( ) { return Ok ( false ) ; } if new_delegation . version ( ) != trusted_delegation_description . version ( ) { return Err ( Error :: VerificationFailure ( format ! ( " \
 " role trusted_delegation_description version ( ) new_delegation version ( ) ) ) ) ; } if new_delegation . expires ( ) <= & Utc :: now ( ) { // TODO this needs to be chagned to accept a MetadataPath and not Role return Err ( Error :: ExpiredMetadata ( Role :: Targets ) ) ; } new_delegation } ; let _ = self . trusted_delegations . insert ( role . clone ( ) , verified ) ; Ok ( true ) }
Verify and update a delegation metadata.
Verify and update a delegation metadata .
&mut self
parent_role
&MetadataPath
role
&MetadataPath
raw_delegation
&RawSignedMetadata<D, TargetsMetadata>
&mut self
parent_role
&MetadataPath
role
&MetadataPath
raw_delegation
&RawSignedMetadata<D, TargetsMetadata>