Skip to content

Metadata API: add _Delegator.get_delegate_signing_status() #2449

@lukpueh

Description

@lukpueh

_Delegator.verify_delegate provides a binary answer for whether a delegated role has enough valid signatures to meet the threshold of keys defined by its delegator or not.

While this is sufficient for client validation, TUF applications might also be interested in more granular information, e.g. when implementing a distributed signing feature for TUF metadata, so they can tell users how many signatures by what keys are still missing.

Interesting information would be:

  • set of valid signatures
  • set of invalid signatures (this would require validating all signatures; verify_threshold only verifies until threshold is met)
  • optional: eligible keys, used keys, remaining keys (maybe out of scope)

Given that threshold verification is such a crucial part of the Metadata API and can be done wrong so easily, adding a new public function -- e.g. _Delegator.get_delegate_signing_status() -- to Metadata API seems like a good idea.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions