How to use/test ? Missing versions.gz

[digital-sapphire]

How to use/test ? Missing versions.gz

[JMSwag]

I'm pretty sure this is the bug I found today at work. There is an issue somewhere with importing the keyfile. I'm investigating now.

[JPFrancoia]

Something like no key file, no versions.gz file ?

[JMSwag]

First let me apologize for not answering your questions.

Signing is essential to the security of this library. It adds a signature to the version file which the client verifies with the public key. Signing also generates the versions.gz & keys.gz archives. Once you have those the call to update_check will return an update object which you can call the downlod & extract_restart to complete your update.

The bug mentioned above is unrelated to this.

Will you be using AWS S3 or your own server? May I ask why you don't want to sign your metadata?

[JPFrancoia]

First let me apologize for not answering your questions.

Don't worry, we all have a job and we are all busy.

Signing is essential to the security of this library. It adds a signature to the version file which the client verifies with the public key. Signing also generates the versions.gz & keys.gz archives.

So basically, I have to sign my package to get those two files ? My bad if I didn't follow completely the procedure, I thought I could bypass the signing part.

Will you be using AWS S3 or your own server?

Nope, I'll be using a shared server (provider: OVH). I'll upload the files via FTP.

May I ask why you don't want to sign your metadata?

No particular reason. I've never done it, so I don't know what the benefits could be (maybe you can tell me more about it, or give me a link ?).

For now I'm just testing, so I thought I could start without the additional layer of complexity that the signing part is.

[JMSwag]

PyUpdater is a simplified, but still relatively secure, version of TUF.
Example of updating with the TUF client.

Check the TUF spec. It's good!

[privateOmega]

@JMSwag Sorry for commenting on an old issue, but I didnt want to open a new one since I am also stuck with the whole versions.gz file being missing.

Would versions.gz be generated only during signing, and could we bypass that?

Tbh, I am not able to follow the process of creating a keypack and signing it, and I am doing a POC and wanted a minimal attempt.