Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create static metadata to demonstrate attacks #870

Closed
wants to merge 19 commits into from

Conversation

snahil28
Copy link

Please fill in the fields below to submit a pull request. The more information
that is provided, the better.

Fixes issue #: Create static metadata that demonstrate attacks #360

Description of the changes being introduced by the pull request:
This pull request includes static metadata to simulate known attacks that TUF prevents, these can be fed to implementation to test if it handles the attacks appropriately.

Please verify and check that the pull request fulfils the following
requirements
:

  • The code follows the Code Style Guidelines
  • Tests have been added for the bug fix or new feature
  • Docs have been added for the bug fix or new feature

@awwad awwad changed the title #360 (https://github.com/theupdateframework/tuf/issues/360) Create static metadata to demonstrate attacks May 16, 2019
@jku
Copy link
Member

jku commented Aug 6, 2020

The premise is great but I think the approach has flaws:

  • this is a lot of generated data being stored in git, without info on how it was generated.
  • Some of this data will become obsolete over time and debugging it is tricky (how could I tell if there was a copy-paste error already in the PR?)
  • None of this data is being automatically tested for correctness
  • there's a lot of example code in the documents. That code is not being tested

Any data in the repo must get tested automatically. In my opinion storing generated data is also wrong (publishing generated data is fine: the source of truth should be the scripts that generated the data). The PR is over a year old: I think it should be declined as it is, a better approach is required.

@joshuagl
Copy link
Member

Closing this PR, a PR implementing the same premise with automated code would be very welcome.

@joshuagl joshuagl closed this Sep 10, 2020
@lukpueh lukpueh mentioned this pull request Sep 10, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants