Transition to the newest version of TUF

setup.py

@@ -55,12 +55,12 @@
         "click==8.*",
         "colorama>=0.3.9",
         "tuf==5.*",
-        # "cryptography>=40.0.0",
+        "cryptography==43.0.*",
         "securesystemslib==1.*",
         "loguru==0.7.*",
         'pygit2==1.9.*; python_version < "3.11"',
         'pygit2==1.14.*; python_version >= "3.11"',
-        "pyOpenSSL==22.1.*",
+        "pyOpenSSL==24.2.*",
         "logdecorator==2.*",
     ],
     "extras_require": {

taf/api/api_workflow.py

@@ -75,7 +75,6 @@ def manage_repo_and_signers(
             # restore metadata, leave targets as they might have been modified by the user
             # TODO flag for also resetting targets?
             # also update the CLI error handling
-            import pdb; pdb.set_trace()
             auth_repo.restore(paths_to_reset_on_error)
 
         raise TAFError from e

taf/api/roles.py

@@ -274,7 +274,7 @@ def add_multiple_roles(
 
     roles_to_add = [role_data.name for role_data in new_roles_data]
     commit_msg = git_commit_message("add-roles", roles=", ".join(roles_to_add))
-    roles_to_load = [role_data.parent.name for role_data in new_roles_data]
+    roles_to_load = [role_data.parent.name for role_data in new_roles_data if role_data.parent.name not in roles_to_add]
     keystore_path = roles_keys_data_new.keystore
 
     with manage_repo_and_signers(
@@ -288,7 +288,6 @@ def add_multiple_roles(
         commit=commit,
         push=push,
     ):
-
         all_signers = {}
         for role_to_add_data in roles_to_add_data:
             signers, _ = load_sorted_keys_of_new_roles(

taf/tests/conftest.py

@@ -39,7 +39,9 @@ def pytest_generate_tests(metafunc):
 
 @fixture(scope="module", autouse=True)
 def repo_dir():
-    path = CLIENT_DIR_PATH / "repos"
+    path = CLIENT_DIR_PATH
+    if path.is_dir():
+        shutil.rmtree(path, onerror=on_rm_error)
     path.mkdir()
     yield path
     shutil.rmtree(path, onerror=on_rm_error)
@@ -54,7 +56,7 @@ def keystore():
 @fixture(scope="module")
 def keystore_delegations():
     """Create signer from some rsa test key."""
-    return TEST_DATA_PATH / "keystores" / "keystore_no_delegations"
+    return TEST_DATA_PATH / "keystores" / "keystore_delegations"
 
 
 @fixture(scope="module")
@@ -67,6 +69,11 @@ def with_delegations_no_yubikeys_input():
     return json.loads(WITH_DELEGATIONS.read_text())
 
 
+@fixture(scope="module")
+def with_delegations_no_yubikeys_path():
+    return WITH_DELEGATIONS
+
+
 @fixture(scope="module")
 def signers(keystore):
     return _load_signers_from_keystore(keystore)

taf/tests/test_api/conftest.py

@@ -1,7 +1,12 @@
 import json
 
 from pathlib import Path
+import shutil
+import uuid
+from taf.api.repository import create_repository
+from taf.auth_repo import AuthenticationRepository
 from taf.tests.conftest import KEYSTORES_PATH, TEST_DATA_PATH
+from taf.utils import on_rm_error
 
 from pytest import fixture
 
@@ -21,7 +26,6 @@
 INVALID_PATH_INPUT = REPOSITORY_DESCRIPTION_INPUT_DIR / "invalid_path.json"
 OLD_YUBIKEY_INPUT = REPOSITORY_DESCRIPTION_INPUT_DIR / "with_old_yubikey.json"
 
-KEYSTORE_PATH = KEYSTORES_PATH / "api_keystore"
 REPOSITORIES_JSON_PATH = TEST_INIT_DATA_PATH / "repositories.json"
 MIRRORS_JSON_PATH = TEST_INIT_DATA_PATH / "mirrors.json"
 
@@ -31,8 +35,46 @@ def _read_json(path):
 
 
 @fixture
-def api_keystore():
-    return str(KEYSTORE_PATH)
+def auth_repo_path(repo_dir):
+    random_name = str(uuid.uuid4())
+    path = repo_dir / "api" / random_name / "auth"
+    yield path
+    shutil.rmtree(path.parent, onerror=on_rm_error)
+
+
+@fixture
+def auth_repo(auth_repo_path, keystore_delegations, no_yubikeys_path):
+    repo_path = str(auth_repo_path)
+    create_repository(
+        repo_path,
+        roles_key_infos=no_yubikeys_path,
+        keystore=keystore_delegations,
+        commit=True,
+        test=True,
+    )
+    auth_repo = AuthenticationRepository(path=repo_path)
+    yield auth_repo
+
+
+@fixture
+def auth_repo_with_delegations(auth_repo_path, keystore_delegations, with_delegations_no_yubikeys_path):
+    repo_path = str(auth_repo_path)
+    create_repository(
+        repo_path,
+        roles_key_infos=with_delegations_no_yubikeys_path,
+        keystore=keystore_delegations,
+        commit=True,
+        test=True,
+    )
+    auth_repo = AuthenticationRepository(path=repo_path)
+    yield auth_repo
+
+
+@fixture(scope="module")
+def api_repo_path(repo_dir):
+    path = repo_dir / "api" / "auth"
+    yield path
+    shutil.rmtree(path.parent, onerror=on_rm_error)
 
 
 @fixture
@@ -59,7 +101,6 @@ def no_yubikeys_path():
 def with_delegations_json_input():
     return _read_json(WITH_DELEGATIONS_INPUT)
 
-
 @fixture
 def invalid_public_key_json_input():
     return _read_json(INVALID_PUBLIC_KEY_INPUT)

taf/tests/test_api/test_create_repository.py

@@ -1,9 +1,6 @@
-import shutil
-import uuid
 from pathlib import Path
 
 from taf.constants import METADATA_DIRECTORY_NAME, TARGETS_DIRECTORY_NAME
-from pytest import fixture
 from typing import Dict
 from taf.api.repository import create_repository
 from taf.auth_repo import AuthenticationRepository
@@ -14,15 +11,6 @@
     copy_repositories_json,
 )
 from taf.updater.updater import validate_repository
-from taf.utils import on_rm_error
-
-
-@fixture
-def auth_repo_path(repo_dir):
-    random_name = str(uuid.uuid4())
-    path = repo_dir / random_name / "auth"
-    yield path
-    shutil.rmtree(path.parent, onerror=on_rm_error)
 
 
 def _check_repo_initialization_successful(auth_repo: AuthenticationRepository, is_targets_initialized=True):
@@ -43,12 +31,12 @@ def _check_repo_initialization_successful(auth_repo: AuthenticationRepository, i
 
 
 def test_create_repository_when_no_delegations(
-    auth_repo_path: Path, no_yubikeys_path: str, keystore_delegations: str
+    auth_repo_path: Path, with_delegations_no_yubikeys_path: str, keystore_delegations: str
 ):
     repo_path = str(auth_repo_path)
     create_repository(
         repo_path,
-        roles_key_infos=no_yubikeys_path,
+        roles_key_infos=with_delegations_no_yubikeys_path,
         keystore=keystore_delegations,
         commit=True,
     )
@@ -58,12 +46,12 @@ def test_create_repository_when_no_delegations(
     validate_repository(repo_path)
 
 def test_create_repository_when_no_delegations_with_test_flag(
-    auth_repo_path: Path, no_yubikeys_path: str, keystore_delegations: str
+    auth_repo_path: Path, with_delegations_no_yubikeys_path: str, keystore_delegations: str
 ):
     repo_path = str(auth_repo_path)
     create_repository(
         repo_path,
-        roles_key_infos=no_yubikeys_path,
+        roles_key_infos=with_delegations_no_yubikeys_path,
         keystore=keystore_delegations,
         commit=True,
         test=True,

taf/tests/test_api/test_dependencies.py

@@ -42,20 +42,20 @@ def parent_repo_path():
 def test_setup_repositories(
     child_repo_path: Path,
     parent_repo_path: Path,
-    no_yubikeys_path: str,
-    api_keystore: str,
+    with_delegations_no_yubikeys_path: str,
+    keystore_delegations: str,
 ):
     for path in (child_repo_path, parent_repo_path):
         create_repository(
             str(path),
-            roles_key_infos=no_yubikeys_path,
-            keystore=api_keystore,
+            roles_key_infos=with_delegations_no_yubikeys_path,
+            keystore=keystore_delegations,
             commit=True,
         )
 
 
 def test_add_dependency_when_on_filesystem_invalid_commit(
-    parent_repo_path, child_repo_path, api_keystore
+    parent_repo_path, child_repo_path, keystore_delegations
 ):
     auth_repo = AuthenticationRepository(path=parent_repo_path)
     initial_commits_num = len(auth_repo.list_commits())
@@ -65,7 +65,7 @@ def test_add_dependency_when_on_filesystem_invalid_commit(
         add_dependency(
             path=str(parent_repo_path),
             dependency_name=child_repository.name,
-            keystore=api_keystore,
+            keystore=keystore_delegations,
             branch_name="main",
             out_of_band_commit="66d7f48e972f9fa25196523f469227dfcd85c994",
             no_prompt=True,
@@ -76,7 +76,7 @@ def test_add_dependency_when_on_filesystem_invalid_commit(
 
 
 def test_add_dependency_when_on_filesystem(
-    parent_repo_path, child_repo_path, api_keystore
+    parent_repo_path, child_repo_path, keystore_delegations
 ):
     auth_repo = AuthenticationRepository(path=parent_repo_path)
     initial_commits_num = len(auth_repo.list_commits())
@@ -85,7 +85,7 @@ def test_add_dependency_when_on_filesystem(
     add_dependency(
         path=str(parent_repo_path),
         dependency_name=child_repository.name,
-        keystore=api_keystore,
+        keystore=keystore_delegations,
         branch_name=None,
         out_of_band_commit=None,
         no_prompt=True,
@@ -106,15 +106,15 @@ def test_add_dependency_when_on_filesystem(
     }
 
 
-def test_add_dependency_when_not_on_filesystem(parent_repo_path, api_keystore):
+def test_add_dependency_when_not_on_filesystem(parent_repo_path, keystore_delegations):
     auth_repo = AuthenticationRepository(path=parent_repo_path)
     initial_commits_num = len(auth_repo.list_commits())
     branch_name = "main"
     out_of_band_commit = "66d7f48e972f9fa25196523f469227dfcd85c994"
     add_dependency(
         path=str(parent_repo_path),
         dependency_name=DEPENDENCY_NAME,
-        keystore=api_keystore,
+        keystore=keystore_delegations,
         branch_name=branch_name,
         out_of_band_commit=out_of_band_commit,
         no_prompt=True,
@@ -135,15 +135,15 @@ def test_add_dependency_when_not_on_filesystem(parent_repo_path, api_keystore):
     }
 
 
-def test_remove_dependency(parent_repo_path, child_repo_path, api_keystore):
+def test_remove_dependency(parent_repo_path, child_repo_path, keystore_delegations):
     auth_repo = AuthenticationRepository(path=parent_repo_path)
     initial_commits_num = len(auth_repo.list_commits())
     child_repository = AuthenticationRepository(path=child_repo_path)
 
     remove_dependency(
         path=str(parent_repo_path),
         dependency_name=child_repository.name,
-        keystore=api_keystore,
+        keystore=keystore_delegations,
         push=False,
     )
     commits = auth_repo.list_commits()