in tuftool/src/add_role.rs [145:212]
fn with_repo_editor(&self, role: &str, mut editor: RepositoryEditor) -> Result<()> {
// Since we are using repo editor we will sign snapshot and timestamp
// Check to make sure all versions and expirations are present
let snapshot_version = self.snapshot_version.context(error::MissingSnafu {
what: "snapshot version".to_string(),
})?;
let snapshot_expires = self.snapshot_expires.context(error::MissingSnafu {
what: "snapshot expires".to_string(),
})?;
let timestamp_version = self.timestamp_version.context(error::MissingSnafu {
what: "timestamp version".to_string(),
})?;
let timestamp_expires = self.timestamp_expires.context(error::MissingSnafu {
what: "timestamp expires".to_string(),
})?;
let paths = if let Some(paths) = &self.paths {
PathSet::Paths(paths.clone())
} else if let Some(path_hash_prefixes) = &self.path_hash_prefixes {
PathSet::PathHashPrefixes(path_hash_prefixes.clone())
} else {
// Should warn that no paths are being delegated
PathSet::Paths(Vec::new())
};
// Sign the top level targets (it's currently the one in targets_editor)
editor
.targets_version(self.version)
.context(error::DelegationStructureSnafu)?
.targets_expires(self.expires)
.context(error::DelegationStructureSnafu)?
.sign_targets_editor(&self.keys)
.context(error::DelegateeNotFoundSnafu {
role: role.to_string(),
})?;
// Change the targets in targets_editor to the one we need to add the new role to
editor
.change_delegated_targets(role)
.context(error::DelegateeNotFoundSnafu {
role: role.to_string(),
})?;
// Add the new role to the signing role
editor
.add_role(
&self.delegatee,
self.indir.as_str(),
paths,
self.threshold,
None,
)
.context(error::LoadMetadataSnafu)?
.targets_version(self.version)
.context(error::DelegationStructureSnafu)?
.targets_expires(self.expires)
.context(error::DelegationStructureSnafu)?
.snapshot_version(snapshot_version)
.snapshot_expires(snapshot_expires)
.timestamp_version(timestamp_version)
.timestamp_expires(timestamp_expires);
let signed_repo = editor.sign(&self.keys).context(error::SignRepoSnafu)?;
let metadata_destination_out = &self.outdir.join("metadata");
signed_repo
.write(metadata_destination_out)
.context(error::WriteRolesSnafu {
roles: [self.delegatee.clone(), role.to_string()].to_vec(),
})?;
Ok(())
}