theupdateframework/python-tuf

ngclient: Make updater.config immutable

Opened this issue · 0 comments

jku commented

This comes from #2363 / #2359 : we should make the config somehow immutable once it's been used by Updater. This should be a difficult mistake to make:

updater = Updater(...) 
updater.refresh()
updater.config.offline = True

(the issue is refresh() already used config.offline: the value can't be changed during lifetime of Updater. Likely this makes sense for all config)

I originally suggested reading the updater.config.offline value only once during initialization, but that still makes writing the above code possible. Would be better if it failed linting.

I suppose two possible actions:

  • Updater.config becomes a read only property (or not public at all)
  • Could make UpdaterConfig frozen=True as well