Restore TUF fallback for mapped network errors - #26
Conversation
Coverage Report for CI Build 33704109791Coverage increased (+0.01%) to 70.502%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
There was a problem hiding this comment.
🟡 Changes recommended
isNetworkFailure currently treats all AppUpdaterNetworkError values as network failures, which can incorrectly classify cancellations unless .cancelled is explicitly excluded.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR restores Sigstore TUF refresh fallback behavior by treating mapped URLError values (AppUpdaterNetworkError) as transport/network failures, ensuring the client can fall back to verified cached metadata or embedded trusted-root when the network is transiently unavailable.
Changes:
- Update
TUFClient.isNetworkFailureto recognizeAppUpdaterNetworkErroras a network failure. - Add a regression test covering the mapped offline error path to ensure embedded fallback is used.
File summaries
| File | Description |
|---|---|
| Attestation/TUF.swift | Extend network-failure detection to include AppUpdaterNetworkError so TUF refresh can fall back appropriately. |
| Tests/AppUpdaterTests/TUFTests.swift | Add regression test verifying mapped offline errors trigger the embedded fallback trusted-root path. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🟢 Approval recommended
The change precisely aligns the network-failure classifier with the mapped error type and is backed by focused regression tests covering both the fallback and cancellation behavior.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Summary
NetworkTransfermaps ordinaryURLErrorvalues intoAppUpdaterNetworkError, butTUFClient.isNetworkFailurestill recognized only raw URL errors and two olderAppUpdaterErrorcases. A transient transport failure during Sigstore TUF refresh therefore skipped the verified cache and embedded trusted-root fallback and surfaced as an attestation verification failure.AppUpdaterNetworkErroras the transport failure it representsThis restores the fallback behavior from before network errors gained safe host-aware descriptions. Cryptographically invalid, expired, rolled-back, malformed, and oversized metadata still fail closed.
Reported through automic-vault#93.
Tests
swift test --filter TUFTests/testMappedNetworkFailureUsesEmbeddedFallback(red before, green after)