theupdateframework / go-tuf

Go implementation of The Update Framework (TUF)
https://theupdateframework.com
Apache License 2.0
625 stars 105 forks source link

fix(localMeta): Ignore deleted delegated targets #522

Closed BaptisteFoy closed 11 months ago

BaptisteFoy commented 1 year ago

https://github.com/theupdateframework/go-tuf/pull/384 didn't fix the whole issue it intended to fix, this PR intends to complete it.

Types of changes:

Description of the changes being introduced by the pull request:

The way #384 works is that, to add delegated targets to the localMeta while verifying them (as requested per https://github.com/theupdateframework/go-tuf/pull/384#discussion_r972099602), it will fetch target files and verify the whole delegation chain to add delegated targets to the localMeta (as loadLocalMetaFromSnapshot leverages the localMeta). To do so, as the localMeta is empty and can't be leveraged, we pull delegated targets and target files from the remote store.

The problem is that such files can be deleted in the remote store in the mean time, leading to two errors:

This PR ignores these errors as they are part of the normal behaviour of the localMeta load algorithm. Note that it doesn't fix https://github.com/theupdateframework/go-tuf/issues/444.

Please verify and check that the pull request fulfills the following requirements: