Skip to content

cli: --offline means fully offline#1143

Merged
woodruffw merged 5 commits intomainfrom
ww/fully-offline
Sep 26, 2024
Merged

cli: --offline means fully offline#1143
woodruffw merged 5 commits intomainfrom
ww/fully-offline

Conversation

@woodruffw
Copy link
Copy Markdown
Member

@woodruffw woodruffw commented Sep 26, 2024 •
edited
Loading

With this change, --offline also disables TUF
repository updates and not just online log lookups.

Needs unit and integration tests; working on that now.

Closes #483. Closes #376.

CC @sethmlarson

@woodruffw
cli: --offline means fully offline
0d52bde 
With this change, `--offline` also disables TUF
repository updates and not just online log lookups.

Closes #483.

Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw woodruffw added component:cli CLI components component:verification Core verification functionality labels Sep 26, 2024
@woodruffw woodruffw self-assigned this Sep 26, 2024
@woodruffw
CHANGELOG: record changes
3678ba3 
Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw
test_verifier: add offline bundle test
b54d6c6 
Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw
Copy link
Copy Markdown
Member Author

woodruffw commented Sep 26, 2024

Bundle verification in the offline tests passes:

test/unit/verify/test_verifier.py::test_verifier_bundle_offline[bundle.txt] PASSED [ 95%]
test/unit/verify/test_verifier.py::test_verifier_bundle_offline[bundle_v3.txt] PASSED [ 96%]
test/unit/verify/test_verifier.py::test_verifier_bundle_offline[bundle_v3_alt.txt] PASSED [ 96%]

I think the last remaining thing to do here is figure out an appropriate log/warning message to raise: passing --offline now means that the user doesn't get the security benefits of checking the TUF repo for revocations. The security impact of this may be marginal in practice (especially if the local trust root was updated recently anyways), but we should still notify the user that their posture is slightly different.

@woodruffw
tuf: add a warning
78186de 
Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw
README: offline verification example
4de5d59 
Signed-off-by: William Woodruff <william@trailofbits.com>
@woodruffw woodruffw requested review from di and jku September 26, 2024 16:37
@woodruffw woodruffw mentioned this pull request Sep 26, 2024
Closed
@woodruffw woodruffw mentioned this pull request Sep 26, 2024
Closed
@woodruffw woodruffw merged commit af8c575 into main Sep 26, 2024
@woodruffw woodruffw deleted the ww/fully-offline branch September 26, 2024 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@di di di approved these changes

@jku jku Awaiting requested review from jku

Assignees

@woodruffw woodruffw

Labels

component:cli CLI components component:verification Core verification functionality

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CLI: --offline should mean fully offline _internal/tuf: Avoid constant metadata updates

2 participants

@woodruffw @di