rust-tuf

rust-tuf copied to clipboard

It's possible that a parser bug could allow for a man-in-the-middle attacker to compromise a system. None have been found so far in serde_json, but other parsers have had bugs...

erickt

Use `failure` crate for errors instead of a enum

1

heartsucker

Since the delegating targets defines the valid keys a delegated targets can be signed by, it is possible for delegated targets to be valid when accessed via one target path...

wellsie1116

If a request for metadata or target contains a max length and the HTTP response contains a Content-Length greater than that value, it can error out the AsyncRead stream without...

wellsie1116

If min_bytes_per_second is non-zero and a transfer is making forward progress but more slowly than required, the stream should error out as expected, however, as poll_read is only expected to...

wellsie1116

tuf::Client will currently error out on create if a fetch of root metadata from the local repository fails with any error other than Error::NotFound. The implementation could attempt to fetch...

wellsie1116

Dependency issue, untrusted = "^0.5"

3

I was attempting to try out rust-tuf in an application, In my Cargo.toml under dependencies, i tried both `tuf = "0.3.0-alpha3"` and `tuf = "0.2.0"` both with the same issue....

Charles-Schleich

RUSTSEC-2019-0031: spin is no longer actively maintained

1

> spin is no longer actively maintained | Details | | | ------------------- | ---------------------------------------------- | | Status | unmaintained | | Package | `spin` | | Version | `0.5.2`...

github-actions[bot]

Support for password protected private keys

2

heartsucker

Consider migrating signing to signatory

5

We are writing our own wrapper around boringssl instead of using ring, so it'd be nice to use our library for signing. One way to implementing this without forcing everyone...

erickt