dennisvang / tufup

Automated updates for stand-alone Python applications.
MIT License
99 stars 2 forks source link

Protect against invalid pre-release key in client update check #120

Closed dennisvang closed 8 months ago

dennisvang commented 8 months ago

The included[pre] call in Client.check_for_updates() will crash the updater if user specifies an invalid pre key:

https://github.com/dennisvang/tufup/blob/b0ae976200192dff8b921b9490196b7a333699d8/src/tufup/client.py#L180

Note, this error only arises if both of the following conditions are true:

Although this constitutes a user error (not a bug), it would be highly inconvenient, so it's best to protect users by preventing this scenario altogether.