role keyids still not ordered

[jku]

We tried to fix issues with this in #1478 but apparently failed. Role keyids in data that we deserialize may be unsorted: We must preserve this order as it affects canonical json. Currently we put the keyids in a set which sorts them.

I suppose we have to make Role.keyids a list again: The only "ordered set" in python seems to be a OrderedDict with keys only -- and that would look weird in an API.

The downside of making Role.keyids a list is that now duplicates could be added to Role.keyids . This should not be a big worry as there is proper API for it: Root.add_key()

[JustinCappos]

Currently we put the keyids in a set which sorts them.

Is there a typo here? Sets are unordered, right?

[jku]

Is there a typo here? Sets are unordered, right?

Set does not preserve input order but the cpython implementation happens to put strings in an alphabetical order -- this is why we did not notice the issue earlier: our test data also had keyids in alphabetical order.