repo: role change should "invalidate" delegated metadata

[jku]

I think currently if a role (delegation) exists, and gets a change that makes the current delegated metadata invalid but does nothing that actually changes the metadata (like threshold is raised with no other changes) , then our tooling does not notice that the repository has invalid metadata in it.

What should happen is that signing event notices the metadata is invalid, and creates a new metadata version for that delegated role in the same signing event: this would force re-signing the delegated metadata as well

[jku]

So signing_event.update_targets() could

• figure out which roles have delegation changes
• for changed delegations, check if the delegated metadata is valid or not
• for invalid roles, create an edit (a version bump) for the delegated metadata

This would force the delegated metadata signers to sign in the same signing event.

However, I'm not sure this is appropriate in every case: what if the delegated metadata is already invalid (e.g. expired) and the signers are not available? This would prevent making changes to the delegation in that situation... This might be acceptable as long as this really applies only to delegations that have changes -- this way changes to delegating metadata can't be blocked because delegated signers are not available: so we should not just test the validity of all delegated roles when delegating metadata is changed, we should only test the ones whose delegation was changed

[jku]

Some more notes after testing a bit:

• Currently we manage most cases of this with the "invites" (signer documents new signer invites in the temp file .signing-event-state, and the repository and other signers consider the signing event incomplete until the invites are accepted). This covers most cases of changing delegations but not all
• What really should happen is more like this:
  • when new signers are added (invited), the signer should add a "placeholder" key into the metadata -- this would mean .signing-event-state file is no longer needed at all
  • repository (signing-event) keeps track of all delegation changes and manages changes to the delegated metadata
    • creates new delegated metadata when delegation is created (currently done by signer)
    • creates new delegated metadata when the signatures are no longer valid (currently not done at all)
    • deletes delegated metadata when delegation is removed (currently not done at all)
    • handles invitations for new signers (currently managed with the temp file)