Verifying fetched metadata about python-tuf HOT 2 CLOSED

The client should now detect outdated metadata it may download by inspecting the new "version" field.

$ ../../client/basic_client.py --repo http://localhost:8001
[2013-03-31 22:01:36,917 UTC] [tuf.download] [INFO] Downloading: http://localhost:8001/metadata/timestamp.txt
Error: 'http://localhost:8001/metadata/timestamp.txt' is older than the version currently installed.
Downloaded version: 1
Current version: 2

from python-tuf.

What the metadata changes now verify:

(1) A valid timestamp (we only check its format). Was the metadata created at a future date? Some other invalid date? We need to better check the metadata's timestamp value.

https://github.com/theupdateframework/tuf/blob/master/tuf/formats.py#L118-L120
The previous date timestamp has been converted to a single integer value, representing the metadata version number. Checking for invalid dates, such as a 'ts' date value that is greater than the present date, is no longer an issue. The client will now only accept metadata with version numbers greater than the current. Comparing integers becomes a much simpler affair.

(2) That the downloaded metadata is newer than our current version.

https://github.com/theupdateframework/tuf/blob/master/tuf/client/updater.py#L711-L724
The previous implementation did not verify that the timestamp of the downloaded metadata was newer than the current version. As stated above, any version greater (i.e., by one, or more, version numbers) than the current one is valid. A bogus clock becomes a non-issue with version numbers; we now at least protect the previous 'ts' field.

(3) Delegated targets metadata have not expired (we only check for the top-level roles).

_refresh_targets_metadata() is called when updating delegated roles. The expiration date is verified on line:
https://github.com/theupdateframework/tuf/blob/master/tuf/client/updater.py#L1365

The repository tools and unit tests were also updated to allow independent version & expiration dates for all metadata on a repository.

from python-tuf.