Fetch targets by HASH.FILENAME.EXT

src/client.rs

@@ -469,7 +469,16 @@ where
         target: &'a TargetPath,
     ) -> Result<Box<dyn AsyncRead + Send + Unpin>> {
         let target_description = self.fetch_target_description(target).await?;
-        self.remote.fetch_target(target, &target_description).await
+
+        // According to TUF section 5.5.2, when consistent snapshot is enabled, target files should
+        // be found at `$HASH.FILENAME.EXT`. Otherwise it is stored at `FILENAME.EXT`.
+        if self.tuf.root().consistent_snapshot() {
+            let (_, value) = crypto::hash_preference(target_description.hashes())?;
+            let target = target.with_hash_prefix(value)?;
+            self.remote.fetch_target(&target, &target_description).await
+        } else {
+            self.remote.fetch_target(target, &target_description).await
+        }
     }
 
     async fn lookup_target_description<'a>(

src/metadata.rs

@@ -1435,6 +1435,18 @@ impl TargetPath {
     pub fn value(&self) -> &str {
         &self.0
     }
+
+    /// Prefix the target path with a hash value to support TUF spec 5.5.2.
+    pub fn with_hash_prefix(&self, hash: &HashValue) -> Result<TargetPath> {
+        let mut components = self.components();
+
+        // The unwrap here is safe because we checked in `safe_path` that the path is not empty.
+        let file_name = components.pop().unwrap();
+
+        components.push(format!("{}.{}", hash, file_name));
+
+        TargetPath::new(components.join("/"))
+    }
 }
 
 /// Description of a target, used in verification.

tests/simple_example.rs

@@ -1,10 +1,10 @@
 use futures_executor::block_on;
 use tuf::client::{Client, Config, PathTranslator};
-use tuf::crypto::{HashAlgorithm, KeyId, PrivateKey, SignatureScheme};
+use tuf::crypto::{self, HashAlgorithm, KeyId, PrivateKey, SignatureScheme};
 use tuf::interchange::Json;
 use tuf::metadata::{
-    MetadataPath, MetadataVersion, RootMetadataBuilder, SnapshotMetadataBuilder, TargetPath,
-    TargetsMetadataBuilder, TimestampMetadataBuilder, VirtualTargetPath,
+    MetadataPath, MetadataVersion, RootMetadataBuilder, SnapshotMetadataBuilder, TargetDescription,
+    TargetPath, TargetsMetadataBuilder, TimestampMetadataBuilder, VirtualTargetPath,
 };
 use tuf::repository::{EphemeralRepository, Repository};
 use tuf::Result;
@@ -131,16 +131,25 @@ where
     //// build the targets ////
 
     let target_file: &[u8] = b"things fade, alternatives exclude";
+    let target_description = TargetDescription::from_reader(target_file, &[HashAlgorithm::Sha256])?;
 
     let target_path = TargetPath::new("foo-bar".into())?;
-    let _ = remote.store_target(target_file, &target_path).await;
+
+    // According to TUF section 5.5.2, when consistent snapshot is enabled, target files should be
+    // stored at `$HASH.FILENAME.EXT`. Otherwise it is stored at `FILENAME.EXT`.
+    if consistent_snapshot {
+        let (_, value) = crypto::hash_preference(target_description.hashes())?;
+        let hash_prefixed_path = target_path.with_hash_prefix(&value)?;
+        let _ = remote.store_target(target_file, &hash_prefixed_path).await;
+    } else {
+        let _ = remote.store_target(target_file, &target_path).await;
+    };
 
     let targets = TargetsMetadataBuilder::new()
-        .insert_target_from_reader(
+        .insert_target_description(
             config.path_translator().real_to_virtual(&target_path)?,
-            target_file,
-            &[HashAlgorithm::Sha256],
-        )?
+            target_description,
+        )
         .signed::<Json>(&targets_key)?;
 
     let targets_path = &MetadataPath::new("targets")?;