Incorrect delegation verification (diamond delegation case)

[jku]

This comes from theupdateframework/tuf-conformance#405

This looks like a valid bug to me, as a diamond shape delegation can in specific circumstances lead to incorrect delegation result:

• if client has already verified a delegation through one branch...
• then when verifying a delegation via the other branch, the delegation is accepted even though it's only signed by the first branch parent delegation

In my opinion diamond delegations likely have no practical use case and should not be used... but it's still a client bug

I'm fixing this in theupdateframework/python-tuf#2977 in python-tuf

[samuraixwandering]

Same skip as python-tuf. In Updater.loadTargets:

role, ok := update.trusted.Targets[roleName]
if ok {
    return role, nil
}

TrustedMetadata.Targets is keyed by role name, so once the role is loaded via one parent, a later lookup via the other parent returns the cache and never calls VerifyDelegate on that parent's keys.

I'll follow theupdateframework/python-tuf#2978: keep the (delegator, role) pair and only skip when both match. I'll add a Go test from the diamond graph in theupdateframework/tuf-conformance#405, using the existing repository simulator.

Opening a PR unless someone is already on this.

[Phantom9869]

I'd say maybe wait for the pr in python-tuf to get merged