|
27 | 27 | class RootVersion:
|
28 | 28 | keys: List[int]
|
29 | 29 | threshold: int
|
30 |
| - signatures: List[int] |
31 |
| - result: Optional[Type[Exception]] = None |
| 30 | + sigs: List[int] |
| 31 | + res: Optional[Type[Exception]] = None |
32 | 32 |
|
33 | 33 |
|
34 | 34 | class TestUpdaterKeyRotations(unittest.TestCase):
|
@@ -87,71 +87,71 @@ def _run_refresh(self) -> None:
|
87 | 87 |
|
88 | 88 | root_rotation_cases = {
|
89 | 89 | "1-of-1 key rotation": [
|
90 |
| - RootVersion([1], 1, [1]), |
91 |
| - RootVersion([2], 1, [2, 1]), |
92 |
| - RootVersion([2], 1, [2]), |
| 90 | + RootVersion(keys=[1], threshold=1, sigs=[1]), |
| 91 | + RootVersion(keys=[2], threshold=1, sigs=[2, 1]), |
| 92 | + RootVersion(keys=[2], threshold=1, sigs=[2]), |
93 | 93 | ],
|
94 | 94 | "1-of-1 key rotation, unused signatures": [
|
95 |
| - RootVersion([1], 1, [3, 1, 4]), |
96 |
| - RootVersion([2], 1, [3, 2, 1, 4]), |
97 |
| - RootVersion([2], 1, [3, 2, 4]), |
| 95 | + RootVersion(keys=[1], threshold=1, sigs=[3, 1, 4]), |
| 96 | + RootVersion(keys=[2], threshold=1, sigs=[3, 2, 1, 4]), |
| 97 | + RootVersion(keys=[2], threshold=1, sigs=[3, 2, 4]), |
98 | 98 | ],
|
99 | 99 | "1-of-1 key rotation fail: not signed with old key": [
|
100 |
| - RootVersion([1], 1, [1]), |
101 |
| - RootVersion([2], 1, [2, 3, 4], UnsignedMetadataError), |
| 100 | + RootVersion(keys=[1], threshold=1, sigs=[1]), |
| 101 | + RootVersion([2], 1, sigs=[2, 3, 4], res=UnsignedMetadataError), |
102 | 102 | ],
|
103 | 103 | "1-of-1 key rotation fail: not signed with new key": [
|
104 |
| - RootVersion([1], 1, [1]), |
105 |
| - RootVersion([2], 1, [1, 3, 4], UnsignedMetadataError), |
| 104 | + RootVersion(keys=[1], threshold=1, sigs=[1]), |
| 105 | + RootVersion([2], 1, [1, 3, 4], res=UnsignedMetadataError), |
106 | 106 | ],
|
107 | 107 | "3-of-5, sign with different keycombos": [
|
108 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 2, 4]), |
109 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 4, 1]), |
110 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 1, 3]), |
111 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 1, 3]), |
| 108 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 2, 4]), |
| 109 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 4, 1]), |
| 110 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 1, 3]), |
| 111 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 1, 3]), |
112 | 112 | ],
|
113 | 113 | "3-of-5, one key rotated": [
|
114 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 2, 4]), |
115 |
| - RootVersion([0, 1, 3, 4, 5], 3, [0, 4, 1]), |
| 114 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 2, 4]), |
| 115 | + RootVersion(keys=[0, 1, 3, 4, 5], threshold=3, sigs=[0, 4, 1]), |
116 | 116 | ],
|
117 | 117 | "3-of-5, one key rotate fails: not signed with 3 new keys": [
|
118 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 2, 4]), |
| 118 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 2, 4]), |
119 | 119 | RootVersion([0, 1, 3, 4, 5], 3, [0, 2, 4], UnsignedMetadataError),
|
120 | 120 | ],
|
121 | 121 | "3-of-5, one key rotate fails: not signed with 3 old keys": [
|
122 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 2, 4]), |
| 122 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 2, 4]), |
123 | 123 | RootVersion([0, 1, 3, 4, 5], 3, [0, 4, 5], UnsignedMetadataError),
|
124 | 124 | ],
|
125 | 125 | "3-of-5, one key rotated, with intermediate step": [
|
126 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 2, 4]), |
127 |
| - RootVersion([0, 1, 3, 4, 5], 3, [0, 2, 4, 5]), |
128 |
| - RootVersion([0, 1, 3, 4, 5], 3, [0, 4, 5]), |
| 126 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 2, 4]), |
| 127 | + RootVersion(keys=[0, 1, 3, 4, 5], threshold=3, sigs=[0, 2, 4, 5]), |
| 128 | + RootVersion(keys=[0, 1, 3, 4, 5], threshold=3, sigs=[0, 4, 5]), |
129 | 129 | ],
|
130 | 130 | "3-of-5, all keys rotated, with intermediate step": [
|
131 |
| - RootVersion([0, 1, 2, 3, 4], 3, [0, 2, 4]), |
132 |
| - RootVersion([5, 6, 7, 8, 9], 3, [0, 2, 4, 5, 6, 7]), |
133 |
| - RootVersion([5, 6, 7, 8, 9], 3, [5, 6, 7]), |
| 131 | + RootVersion(keys=[0, 1, 2, 3, 4], threshold=3, sigs=[0, 2, 4]), |
| 132 | + RootVersion([5, 6, 7, 8, 9], threshold=3, sigs=[0, 2, 4, 5, 6, 7]), |
| 133 | + RootVersion(keys=[5, 6, 7, 8, 9], threshold=3, sigs=[5, 6, 7]), |
134 | 134 | ],
|
135 | 135 | "1-of-3 threshold increase to 2-of-3": [
|
136 |
| - RootVersion([1, 2, 3], 1, [1]), |
137 |
| - RootVersion([1, 2, 3], 2, [1, 2]), |
| 136 | + RootVersion(keys=[1, 2, 3], threshold=1, sigs=[1]), |
| 137 | + RootVersion(keys=[1, 2, 3], threshold=2, sigs=[1, 2]), |
138 | 138 | ],
|
139 | 139 | "1-of-3 threshold bump to 2-of-3 fails: new threshold not reached": [
|
140 |
| - RootVersion([1, 2, 3], 1, [1]), |
141 |
| - RootVersion([1, 2, 3], 2, [2], UnsignedMetadataError), |
| 140 | + RootVersion(keys=[1, 2, 3], threshold=1, sigs=[1]), |
| 141 | + RootVersion([1, 2, 3], 2, sigs=[2], res=UnsignedMetadataError), |
142 | 142 | ],
|
143 | 143 | "2-of-3 threshold decrease to 1-of-3": [
|
144 |
| - RootVersion([1, 2, 3], 2, [1, 2]), |
145 |
| - RootVersion([1, 2, 3], 1, [1, 2]), |
146 |
| - RootVersion([1, 2, 3], 1, [1]), |
| 144 | + RootVersion(keys=[1, 2, 3], threshold=2, sigs=[1, 2]), |
| 145 | + RootVersion([1, 2, 3], threshold=1, sigs=[1, 2]), |
| 146 | + RootVersion([1, 2, 3], threshold=1, sigs=[1]), |
147 | 147 | ],
|
148 | 148 | "2-of-3 threshold decr. to 1-of-3 fails: old threshold not reached": [
|
149 |
| - RootVersion([1, 2, 3], 2, [1, 2]), |
150 |
| - RootVersion([1, 2, 3], 1, [1], UnsignedMetadataError), |
| 149 | + RootVersion(keys=[1, 2, 3], threshold=2, sigs=[1, 2]), |
| 150 | + RootVersion([1, 2, 3], 1, sigs=[1], res=UnsignedMetadataError), |
151 | 151 | ],
|
152 | 152 | "1-of-2 threshold increase to 2-of-2": [
|
153 |
| - RootVersion([1], 1, [1]), |
154 |
| - RootVersion([1, 2], 2, [1, 2]), |
| 153 | + RootVersion(keys=[1], threshold=1, sigs=[1]), |
| 154 | + RootVersion(keys=[1, 2], threshold=2, sigs=[1, 2]), |
155 | 155 | ],
|
156 | 156 | }
|
157 | 157 |
|
@@ -180,13 +180,13 @@ def test_root_rotation(self, root_versions: List[RootVersion]) -> None:
|
180 | 180 | self.sim.root.roles["root"].threshold = rootver.threshold
|
181 | 181 | for i in rootver.keys:
|
182 | 182 | self.sim.root.add_key("root", self.keys[i])
|
183 |
| - for i in rootver.signatures: |
| 183 | + for i in rootver.sigs: |
184 | 184 | self.sim.add_signer("root", self.signers[i])
|
185 | 185 | self.sim.root.version += 1
|
186 | 186 | self.sim.publish_root()
|
187 | 187 |
|
188 | 188 | # run client workflow, assert success/failure
|
189 |
| - expected_result = root_versions[-1].result |
| 189 | + expected_result = root_versions[-1].res |
190 | 190 | if expected_result is None:
|
191 | 191 | self._run_refresh()
|
192 | 192 | expected_local_root = self.sim.signed_roots[-1]
|
|
0 commit comments