diff --git a/tuf/data/roles.go b/tuf/data/roles.go index 94f6721cc1..b1a2988bd0 100644 --- a/tuf/data/roles.go +++ b/tuf/data/roles.go @@ -214,18 +214,6 @@ type Role struct { Paths []string `json:"paths,omitempty"` } -func isValidRootRoleStructure(r RootRole, validKeys Keys) error { - if r.Threshold < 1 { - return fmt.Errorf("invalid threshold: %v ", r.Threshold) - } - for _, keyID := range r.KeyIDs { - if _, ok := validKeys[keyID]; !ok { - return fmt.Errorf("key ID %s specified without corresponding key", keyID) - } - } - return nil -} - // NewRole creates a new Role object from the given parameters func NewRole(name string, threshold int, keyIDs, paths []string) (*Role, error) { if IsDelegation(name) { diff --git a/tuf/data/root.go b/tuf/data/root.go index e32a6ae530..2c5985e5a8 100644 --- a/tuf/data/root.go +++ b/tuf/data/root.go @@ -42,10 +42,25 @@ func isValidRootStructure(r Root) error { return ErrInvalidMetadata{ role: CanonicalRootRole, msg: fmt.Sprintf("missing %s role specification", roleName)} } - if err := isValidRootRoleStructure(*roleObj, r.Keys); err != nil { + if err := isValidRootRoleStructure(CanonicalRootRole, roleName, *roleObj, r.Keys); err != nil { + return err + } + } + return nil +} + +func isValidRootRoleStructure(metaContainingRole, rootRoleName string, r RootRole, validKeys Keys) error { + if r.Threshold < 1 { + return ErrInvalidMetadata{ + role: metaContainingRole, + msg: fmt.Sprintf("invalid threshold specified for %s: %v ", rootRoleName, r.Threshold), + } + } + for _, keyID := range r.KeyIDs { + if _, ok := validKeys[keyID]; !ok { return ErrInvalidMetadata{ - role: CanonicalRootRole, - msg: fmt.Sprintf("role %s: %s", roleName, err.Error()), + role: metaContainingRole, + msg: fmt.Sprintf("key ID %s specified in %s without corresponding key", keyID, rootRoleName), } } } diff --git a/tuf/data/targets.go b/tuf/data/targets.go index c4781c9aae..43b8c07b5f 100644 --- a/tuf/data/targets.go +++ b/tuf/data/targets.go @@ -43,11 +43,8 @@ func isValidTargetsStructure(t Targets, roleName string) error { return ErrInvalidMetadata{ role: roleName, msg: fmt.Sprintf("delegation role %s invalid", roleObj.Name)} } - if err := isValidRootRoleStructure(roleObj.RootRole, t.Delegations.Keys); err != nil { - return ErrInvalidMetadata{ - role: roleName, - msg: fmt.Sprintf("role %s: %s", roleObj.Name, err.Error()), - } + if err := isValidRootRoleStructure(roleName, roleObj.Name, roleObj.RootRole, t.Delegations.Keys); err != nil { + return err } } return nil diff --git a/tuf/testutils/swizzler.go b/tuf/testutils/swizzler.go index 03f30e22e5..737ca67e83 100644 --- a/tuf/testutils/swizzler.go +++ b/tuf/testutils/swizzler.go @@ -559,7 +559,8 @@ func (m *MetadataSwizzler) MutateRoot(mutate func(*data.Root)) error { mutate(&root) - signedThing, err = data.SignedRoot{Signed: root, Signatures: signedThing.Signatures}.ToSigned() + sRoot := &data.SignedRoot{Signed: root, Signatures: signedThing.Signatures} + signedThing, err = sRoot.ToSigned() if err != nil { return err } @@ -591,7 +592,8 @@ func (m *MetadataSwizzler) MutateTimestamp(mutate func(*data.Timestamp)) error { mutate(×tamp) - signedThing, err = data.SignedTimestamp{Signed: timestamp, Signatures: signedThing.Signatures}.ToSigned() + sTimestamp := &data.SignedTimestamp{Signed: timestamp, Signatures: signedThing.Signatures} + signedThing, err = sTimestamp.ToSigned() if err != nil { return err } @@ -623,7 +625,8 @@ func (m *MetadataSwizzler) MutateSnapshot(mutate func(*data.Snapshot)) error { mutate(&snapshot) - signedThing, err = data.SignedSnapshot{Signed: snapshot, Signatures: signedThing.Signatures}.ToSigned() + sSnapshot := &data.SignedSnapshot{Signed: snapshot, Signatures: signedThing.Signatures} + signedThing, err = sSnapshot.ToSigned() if err != nil { return err } @@ -655,7 +658,8 @@ func (m *MetadataSwizzler) MutateTargets(mutate func(*data.Targets)) error { mutate(&targets) - signedThing, err = data.SignedTargets{Signed: targets, Signatures: signedThing.Signatures}.ToSigned() + sTargets := &data.SignedTargets{Signed: targets, Signatures: signedThing.Signatures} + signedThing, err = sTargets.ToSigned() if err != nil { return err }