repo: Use delegation tree to decide which metadata to include in publishing

theupdateframework / tuf-on-ci

A TUF repository and signing tool

Other

20 stars 11 forks source link

Closed jku closed 4 months ago

jku commented 4 months ago

Using snapshot contents is incorrect as snapshot is allowed to contain files that are no longer needed.

Fixes #342

jku commented 4 months ago

self review:

we really should have validation for build_repository(): I resisted the urge to slap some validation code in between as I think it makes sense to make that consciously and use the same code in online-sign as well #343
there is no test for this since tuf-on-ci does not currently have CLI support for removing delegations (issue only came up since sigstore root-signing has removed delegations) -- this is not a big thing to add but it's not been needed so far...