Skip to content

Commit e3d659e

Browse files
dkirov-ddclaude
andcommitted
feat(downloader): bundle 1.root.json; rename --format to --index; drop --root-json
- Bundle metadata/root_history/1.root.json from agent-integrations-tuf as a package resource; TUFPointerDownloader loads it via importlib.resources — no TOFU, no --root-json flag needed - Rename --format v2 to --index (boolean flag); v1 remains the default when --index is absent - Remove trust_anchor parameter from TUFPointerDownloader.__init__ - Drop --format and --root-json from instantiate_downloader (v1 path) - Register 1.root.json as a wheel artifact in pyproject.toml - Update tests to match new interface Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
1 parent fda9976 commit e3d659e

5 files changed

Lines changed: 212 additions & 92 deletions

File tree

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "ac5d650bc9aa17fdad54753fbf64e083f6f613286d0feef991ff61ec26874f2b",
5+
"sig": "3066023100beb16cde4c9e17c725713c6020cb5b11a65dd60a7b46f6842068815593e8f39cfa547ea89b6169474a8ee6a98c22f934023100f215434d25181f6f0d6a75a1bae4f09814678d3409cc0aaf0f8e1cb2b0a7bcb29acd5394b4df1751f7e73c641a17256b"
6+
},
7+
{
8+
"keyid": "6f0f52eb4cb14d590aafd5f7eb8d9a79477ac89794be2d3caade9fc39b3735e6",
9+
"sig": "306502306130792e890c5257cc8fc951e7c9a4009a5552affbd6bdf5cef3bac647de18f82918adbd4edfaa6d1624e2c378ee0ca4023100db6cff59e145b0113560116eac4466e52fc24e3ec3f02ee39fe7213718c2184d58e5473a5f29429b1a4c63e7ff87b83b"
10+
},
11+
{
12+
"keyid": "2d019dcc7a3e8da4d22bf364f0e0cb87937b2ced68339f3c53d305d1a9aadcce",
13+
"sig": "3066023100ed93223b4ab9784c00b73937cd431fe9d6af8906548124a10215ad93432523476a3265e712fe99b7555ea30ce5aeff30023100e55ae85f68da6ac322f912cae2a28facb6b3f014770d348a7c9daee100e5eb8ae78cc86321b20711f3b357d900a075a4"
14+
},
15+
{
16+
"keyid": "e942404daa3e8cb1143ab5f275df2f8c741ae002194147806bd6f05b8e2e816f",
17+
"sig": "3066023100a1a75a85dbe43db459e3d8c1bd935f2717bae0b1cba79ea5b9a5e785b7eb08cc30e08f96ba5fc0ccb9b9c97b9af456450231008dcc197a5de9a93649dfbd27e3f112321441913138c3377487ae85353a982cbffdc88029d681e432e86cfc14c51196ab"
18+
},
19+
{
20+
"keyid": "1286a08794005a5f1d679e56322f45fd3b55aa198f87bdc699f8213048602000",
21+
"sig": "3064023075188913725a1c2e9af59f8663b6a178156b64d87da126a5970a3b6a3399bdfe7f5c357099f2f1a4e83d52294551c41e0230080ef2ff77b7d558879cbe0eda409c3ba2fe080860506d4f2ede314374e39dc0b2bc466af51fdd258eb76171344d42af"
22+
},
23+
{
24+
"keyid": "65ccb05ff16285a3b65ea2db2581ed083bb19acfcbd130d5484c151baf28541f",
25+
"sig": "306602310086b9d6f39f795ad188223318f02e1d78b5798d34e333c1933e55891cc1b11cd6771b2d9ab1f5c1fc707d4815e3cc200d023100eb63f35f7cc2d0166357f2c209ecca63b82fc6bc9c310b9a0fa345957b1a0df102036ea6a6d3825d787eb7d3b3131e70"
26+
},
27+
{
28+
"keyid": "b59ade3245077bd622dc7bf41163a877e05272590cb4830632dc0d034717d735",
29+
"sig": "3066023100fa26ef91f1bb3cdf779cb6bbc43d70bab67a7c66103e61b8998698f469fad0d44002d4a9399ceac304b8ee1a8823fd99023100ecd415e58696ab4778f4bdf5187be3743ac372b29cd139111b3461a0da42f8f44e5bb3ec83c2bd0ce4b6281e585b8889"
30+
},
31+
{
32+
"keyid": "a07e905cad57b71374ef5e408d61936c31957b35026de0b8db3938878ccad637",
33+
"sig": "3066023100f4802957c21a0916677154494c4360260f5994c35c435d2bf2df39bc7cccca7fb437563d21ae128bcaa7909ead7d6e7802310097513f90e5e7dbe4bcb3f9b20308e966ec38960e8cad4869a4b32be8bd98726ded4a68c671d5f22858dd10ba3b56b04a"
34+
},
35+
{
36+
"keyid": "a442c20904f96e3a367e16037665bfb2e002bb2e9586cec4c96d83697a49fa2a",
37+
"sig": "30660231008d58d822ee1accd6bff07e79f171d61d122d35c1d51c86b2f2ada76cff695090fdf859127889f9a8d90e539277b5ab5a023100f0ad8d7ba6a25e27316a91bbc61c9b4d31f42c5c93662ea53d660af6b8ab9ee111b135b6844901ccd281fd9246d5f786"
38+
},
39+
{
40+
"keyid": "8969905969a712d54c9b327939aead62784587b54d1d03cbaa835f79205069bf",
41+
"sig": "3066023100894ecac9291e64ea6b84d168b886ef5829f4ad5b57c83b0ec745b644e4d19983e29c4681b5f744070a679e71fb4325af023100b6365d50a44e59932ea24d17a9fbc975cc7e7b44539d36dc7208470b1ddc9572b06266e149d1793a12a98cd62b803a95"
42+
}
43+
],
44+
"signed": {
45+
"_type": "root",
46+
"consistent_snapshot": true,
47+
"expires": "2027-04-21T15:31:05Z",
48+
"keys": {
49+
"1286a08794005a5f1d679e56322f45fd3b55aa198f87bdc699f8213048602000": {
50+
"keytype": "ecdsa",
51+
"keyval": {
52+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEruzzCikai9w8LqTLE4cxf0qRIFU6AQve\nnMmudDdNo22MCiOwbuYjJJ1dvRlMiSVrAGyv1+37h8aXGa5Qbx5nb4TEIRfaDth8\nhMbKJcQ7OOK/6SaltjNZh3VaZ396/WIC\n-----END PUBLIC KEY-----\n"
53+
},
54+
"scheme": "ecdsa-sha2-nistp384",
55+
"x-tuf-on-ci-keyowner": "@nouemankhal"
56+
},
57+
"2d019dcc7a3e8da4d22bf364f0e0cb87937b2ced68339f3c53d305d1a9aadcce": {
58+
"keytype": "ecdsa",
59+
"keyval": {
60+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAErfozI3wqaB8k6o6Mc7SPFiw8s1dLTaxk\nMmhMsdkk7QIl3t+gFzWNdXANEjN027g4S6Ty2CvdzovU37yD24td9pQBh8LGmfPa\nmU5cxtzRaXkCibibJrrvLxyyZTWZXW6C\n-----END PUBLIC KEY-----\n"
61+
},
62+
"scheme": "ecdsa-sha2-nistp384",
63+
"x-tuf-on-ci-keyowner": "@alexeypilyugin"
64+
},
65+
"4542ee95093cb434e0d80a4bb9dd9d96e6b67cda12759fa2648a7786f822e97d": {
66+
"keytype": "ecdsa",
67+
"keyval": {
68+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEUV4g/gyxCdXKHK07QWO5z6S9lRhL88DO\nOb22g0dCOtxBB2sKojAUw3wXXz+SaUZRFgqfVvezbtsC4LSkkIlwA5MrJDA83kP2\nJRo4BQPtW8wZmtSvkkRQPSfAdXv975pg\n-----END PUBLIC KEY-----\n"
69+
},
70+
"scheme": "ecdsa-sha2-nistp384",
71+
"x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:510233252802:key/9efe9e34-88f3-4ad3-8828-5340561e7c42"
72+
},
73+
"65ccb05ff16285a3b65ea2db2581ed083bb19acfcbd130d5484c151baf28541f": {
74+
"keytype": "ecdsa",
75+
"keyval": {
76+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEi44mg+tnJn41Cy4Lr42lQNRuZaHDY4d+\nB/oYkBRTiHl6n6hc6alGLS/1rWijAfSL7x7wgVeOrA5fp1ornW27vPOkRVWJO5Lv\nZcZXwJYi7svVFBkFjBAtAOF6DGuAEWc9\n-----END PUBLIC KEY-----\n"
77+
},
78+
"scheme": "ecdsa-sha2-nistp384",
79+
"x-tuf-on-ci-keyowner": "@lucia-sb"
80+
},
81+
"6f0f52eb4cb14d590aafd5f7eb8d9a79477ac89794be2d3caade9fc39b3735e6": {
82+
"keytype": "ecdsa",
83+
"keyval": {
84+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEAbWHH4rfNiJFz9gXLPV/QJK0tky4/nW1\nyMPnUe1GRac6UfGcjZvGA7mpmns4FYG1KuHbPhWlEDOQnLjiIiJkY2+Z96tywq6y\n+/e+0Gc2KSsVr0IAWALkTzQE+Q6ru+lj\n-----END PUBLIC KEY-----\n"
85+
},
86+
"scheme": "ecdsa-sha2-nistp384",
87+
"x-tuf-on-ci-keyowner": "@nubtron"
88+
},
89+
"8969905969a712d54c9b327939aead62784587b54d1d03cbaa835f79205069bf": {
90+
"keytype": "ecdsa",
91+
"keyval": {
92+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEkztjp5ixZrKt94qnSn4bisyEdgs0Wre/\nheazr1zx7MJUCLiHim0lEDWCB64m/YLru+W3/PLwTiQSavO62lB6y3ggjcq/ygwA\n5yxi0bP/MAJBZ0Hl+y+Q8BfKTZSrTb6j\n-----END PUBLIC KEY-----\n"
93+
},
94+
"scheme": "ecdsa-sha2-nistp384",
95+
"x-tuf-on-ci-keyowner": "@hadhemidd"
96+
},
97+
"a07e905cad57b71374ef5e408d61936c31957b35026de0b8db3938878ccad637": {
98+
"keytype": "ecdsa",
99+
"keyval": {
100+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEEilQwnno5GxJpoyxulKzkkHa0x0/ERDa\nf3m1ZCpF9SoT2B98T+BwT6noD+qlOwX7VKLFSQwl4/od53tu6Wt3s3P70zFviq+Y\n+chUOSCbA5y/TCvfwx4mLBruXI1QbVOh\n-----END PUBLIC KEY-----\n"
101+
},
102+
"scheme": "ecdsa-sha2-nistp384",
103+
"x-tuf-on-ci-keyowner": "@aarakke"
104+
},
105+
"a442c20904f96e3a367e16037665bfb2e002bb2e9586cec4c96d83697a49fa2a": {
106+
"keytype": "ecdsa",
107+
"keyval": {
108+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEUJ7k4tiIZrWNLhrNrcBBMh4we3GiMlpo\ntwVy72lNw7aMxisK6ttP0mV30Yh1rX37DO6UUdeiWImrYBVfXFkP7z2QD9qKetny\nCeVHycA7uNby7yb7pljv2l2SpTgXACZk\n-----END PUBLIC KEY-----\n"
109+
},
110+
"scheme": "ecdsa-sha2-nistp384",
111+
"x-tuf-on-ci-keyowner": "@iliakur"
112+
},
113+
"ac5d650bc9aa17fdad54753fbf64e083f6f613286d0feef991ff61ec26874f2b": {
114+
"keytype": "ecdsa",
115+
"keyval": {
116+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEAWOvhm6nk7iY+EYK8ZnrxS49yqLf/ZTR\nJ74WY9Kz3ikjyXASkD4IgqJyyrmbMoqS9k6/RM/Zk6CAfPeZneDh1puVAlxy9nJD\nZp/OW78dVOqrlw1uQ0d+gfe7b4TcUNG4\n-----END PUBLIC KEY-----\n"
117+
},
118+
"scheme": "ecdsa-sha2-nistp384",
119+
"x-tuf-on-ci-keyowner": "@dkirov-dd"
120+
},
121+
"b59ade3245077bd622dc7bf41163a877e05272590cb4830632dc0d034717d735": {
122+
"keytype": "ecdsa",
123+
"keyval": {
124+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEd/9wooA4OKbC7hUO1OTZN3pnFbc85PDs\n+izKkDDSqj3yk8Pa39OJstT2BHvrn/B0BKMHhE6T/PN/rhorKVIVZ3UZErn1QCgG\nkkcFfA5MQm92SjIr9zAJea9bVUJhZ+PA\n-----END PUBLIC KEY-----\n"
125+
},
126+
"scheme": "ecdsa-sha2-nistp384",
127+
"x-tuf-on-ci-keyowner": "@sarah-witt"
128+
},
129+
"e942404daa3e8cb1143ab5f275df2f8c741ae002194147806bd6f05b8e2e816f": {
130+
"keytype": "ecdsa",
131+
"keyval": {
132+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3VG/DJn/wmXh3bQ/LLjGMyKubQ1f5/1P\nJTVDYgTh5AC5zWxDSD26PoNpS29MecItPoM+pMy5YC99mwkEkxjNdwIke1Aons92\n8SVtL3BYH311oC6jLtFt+oqEunL5EdgJ\n-----END PUBLIC KEY-----\n"
133+
},
134+
"scheme": "ecdsa-sha2-nistp384",
135+
"x-tuf-on-ci-keyowner": "@kyle-neale"
136+
}
137+
},
138+
"roles": {
139+
"root": {
140+
"keyids": [
141+
"ac5d650bc9aa17fdad54753fbf64e083f6f613286d0feef991ff61ec26874f2b",
142+
"6f0f52eb4cb14d590aafd5f7eb8d9a79477ac89794be2d3caade9fc39b3735e6",
143+
"2d019dcc7a3e8da4d22bf364f0e0cb87937b2ced68339f3c53d305d1a9aadcce",
144+
"e942404daa3e8cb1143ab5f275df2f8c741ae002194147806bd6f05b8e2e816f",
145+
"1286a08794005a5f1d679e56322f45fd3b55aa198f87bdc699f8213048602000",
146+
"65ccb05ff16285a3b65ea2db2581ed083bb19acfcbd130d5484c151baf28541f",
147+
"b59ade3245077bd622dc7bf41163a877e05272590cb4830632dc0d034717d735",
148+
"a07e905cad57b71374ef5e408d61936c31957b35026de0b8db3938878ccad637",
149+
"a442c20904f96e3a367e16037665bfb2e002bb2e9586cec4c96d83697a49fa2a",
150+
"8969905969a712d54c9b327939aead62784587b54d1d03cbaa835f79205069bf"
151+
],
152+
"threshold": 2
153+
},
154+
"snapshot": {
155+
"keyids": [
156+
"4542ee95093cb434e0d80a4bb9dd9d96e6b67cda12759fa2648a7786f822e97d"
157+
],
158+
"threshold": 1,
159+
"x-tuf-on-ci-expiry-period": 365,
160+
"x-tuf-on-ci-signing-period": 60
161+
},
162+
"targets": {
163+
"keyids": [
164+
"ac5d650bc9aa17fdad54753fbf64e083f6f613286d0feef991ff61ec26874f2b",
165+
"6f0f52eb4cb14d590aafd5f7eb8d9a79477ac89794be2d3caade9fc39b3735e6",
166+
"2d019dcc7a3e8da4d22bf364f0e0cb87937b2ced68339f3c53d305d1a9aadcce",
167+
"e942404daa3e8cb1143ab5f275df2f8c741ae002194147806bd6f05b8e2e816f",
168+
"1286a08794005a5f1d679e56322f45fd3b55aa198f87bdc699f8213048602000",
169+
"65ccb05ff16285a3b65ea2db2581ed083bb19acfcbd130d5484c151baf28541f",
170+
"b59ade3245077bd622dc7bf41163a877e05272590cb4830632dc0d034717d735",
171+
"a07e905cad57b71374ef5e408d61936c31957b35026de0b8db3938878ccad637",
172+
"a442c20904f96e3a367e16037665bfb2e002bb2e9586cec4c96d83697a49fa2a",
173+
"8969905969a712d54c9b327939aead62784587b54d1d03cbaa835f79205069bf"
174+
],
175+
"threshold": 1
176+
},
177+
"timestamp": {
178+
"keyids": [
179+
"4542ee95093cb434e0d80a4bb9dd9d96e6b67cda12759fa2648a7786f822e97d"
180+
],
181+
"threshold": 1,
182+
"x-tuf-on-ci-expiry-period-hours": 48,
183+
"x-tuf-on-ci-signing-period-hours": 24
184+
}
185+
},
186+
"spec_version": "1.0.31",
187+
"version": 1,
188+
"x-tuf-on-ci-expiry-period": 365,
189+
"x-tuf-on-ci-signing-period": 60
190+
}
191+
}

datadog_checks_downloader/datadog_checks/downloader/cli.py

Lines changed: 6 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -97,27 +97,7 @@ def instantiate_downloader():
9797
'-v', '--verbose', action='count', default=0, help='Show verbose information about TUF and in-toto.'
9898
)
9999

100-
parser.add_argument(
101-
'--format',
102-
type=str,
103-
default='v1',
104-
choices=['v1', 'v2'],
105-
help=(
106-
'Repository format: v1 (default, simple-index + in-toto) or '
107-
'v2 (pointer-file + sha256, used by agent-integrations-tuf).'
108-
),
109-
)
110100

111-
parser.add_argument(
112-
'--root-json',
113-
type=str,
114-
default=None,
115-
metavar='PATH',
116-
help=(
117-
'[v2 only] Path to the initial root.json that bootstraps the TUF trust chain. '
118-
'Defaults to TOFU (fetch from the repository) when omitted.'
119-
),
120-
)
121101

122102
args = parser.parse_args()
123103
repository_url_prefix = args.repository
@@ -167,13 +147,12 @@ def run_downloader(tuf_downloader, standard_distribution_name, version, ignore_p
167147

168148

169149
def download():
170-
# Peek at --format before delegating. instantiate_downloader() handles v1
171-
# only; we handle v2 here so that v1 call-sites are unaffected.
150+
# Peek at --index before delegating so that v1 call-sites are unaffected.
172151
parser = argparse.ArgumentParser(add_help=False)
173-
parser.add_argument('--format', default='v1', choices=['v1', 'v2'])
152+
parser.add_argument('--index', action='store_true', default=False)
174153
partial_args, _ = parser.parse_known_args()
175154

176-
if partial_args.format == 'v2':
155+
if partial_args.index:
177156
_download_v2()
178157
else:
179158
tuf_downloader, standard_distribution_name, version, ignore_python_version = instantiate_downloader()
@@ -191,20 +170,13 @@ def _download_v2():
191170
)
192171
parser.add_argument('--repository', type=str, required=True, help='HTTPS base URL of the v2 TUF repository.')
193172
parser.add_argument('--version', type=str, default=None, help='Version to download (default: latest stable).')
194-
parser.add_argument(
195-
'--root-json',
196-
type=str,
197-
default=None,
198-
metavar='PATH',
199-
help='Path to the initial root.json trust anchor (omit to use TOFU).',
200-
)
201173
parser.add_argument(
202174
'--unsafe-disable-verification',
203175
action='store_true',
204176
help='Disable TUF verification and wheel digest checks.',
205177
)
206178
parser.add_argument('-v', '--verbose', action='count', default=0)
207-
parser.add_argument('--format', default='v2', choices=['v1', 'v2']) # consumed upstream; kept for completeness
179+
parser.add_argument('--index', action='store_true', default=True) # consumed upstream; kept for completeness
208180

209181
# v1 flags that are not applicable in v2: accept and warn so that callers
210182
# upgrading from v1 get a clear message instead of an argument error.
@@ -224,17 +196,15 @@ def _download_v2():
224196
raise NonCanonicalVersion(args.version)
225197

226198
if args._type_ignored is not None:
227-
sys.stderr.write('WARNING: --type is not applicable with --format v2 and will be ignored.\n')
199+
sys.stderr.write('WARNING: --type is not applicable with --index and will be ignored.\n')
228200
if args._ignore_python_version:
229201
sys.stderr.write(
230-
'NOTE: --ignore-python-version is not applicable with --format v2 '
202+
'NOTE: --ignore-python-version is not applicable with --index '
231203
'(wheel selection happens at publish time).\n'
232204
)
233205

234-
trust_anchor = Path(args.root_json) if args.root_json else None
235206
downloader = TUFPointerDownloader(
236207
repository_url=args.repository,
237-
trust_anchor=trust_anchor,
238208
verbose=args.verbose,
239209
disable_verification=args.unsafe_disable_verification,
240210
)

datadog_checks_downloader/datadog_checks/downloader/download_v2.py

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@
66
77
The v2 format stores a JSON pointer file as a TUF target at:
88
9-
targets/<project>/<version>.json (versioned)
10-
targets/<project>/latest.json (latest stable, updated on each release)
9+
targets/<project>/<version>.json (versioned pointer)
1110
1211
Each pointer file contains:
1312
@@ -26,9 +25,9 @@
2625
"""
2726

2827
import hashlib
28+
import importlib.resources
2929
import json
3030
import logging
31-
import shutil
3231
import tempfile
3332
import urllib.error
3433
import urllib.request
@@ -47,18 +46,12 @@ class TUFPointerDownloader:
4746
def __init__(
4847
self,
4948
repository_url: str,
50-
trust_anchor: Path | None = None,
5149
verbose: int = 0,
5250
disable_verification: bool = False,
5351
):
5452
"""
5553
repository_url: HTTPS base URL of the TUF repository, e.g.
5654
'https://agent-integration-wheels-staging.s3.amazonaws.com'
57-
trust_anchor: Path to the initial root.json that seeds the TUF
58-
trust chain. When None, root.json is fetched from
59-
the repository on first use (TOFU — only safe in
60-
controlled CI environments where the caller already
61-
trusts the transport, e.g. via GitHub Actions OIDC).
6255
disable_verification: Skip TUF metadata verification and wheel digest
6356
checks. Use only as a break-glass escape hatch
6457
(mirrors --unsafe-disable-verification in v1).
@@ -68,7 +61,6 @@ def __init__(
6861
logging.basicConfig(format='%(levelname)-8s: %(message)s', level=level)
6962

7063
self._repository_url = repository_url.rstrip('/')
71-
self._trust_anchor = trust_anchor
7264
self._disable_verification = disable_verification
7365

7466
if disable_verification:
@@ -82,16 +74,10 @@ def __init__(
8274
# ------------------------------------------------------------------
8375

8476
def _bootstrap_metadata_dir(self, metadata_dir: Path) -> None:
85-
"""Seed *metadata_dir* with the initial root.json trust anchor."""
77+
"""Seed *metadata_dir* with the bundled initial root.json trust anchor."""
8678
dest = metadata_dir / 'root.json'
87-
if self._trust_anchor is not None:
88-
shutil.copy2(self._trust_anchor, dest)
89-
else:
90-
# TOFU: fetch the versioned initial root from the repository.
91-
url = f'{self._repository_url}/metadata/1.root.json'
92-
logger.debug('Fetching initial root from %s (TOFU)', url)
93-
with urllib.request.urlopen(url) as resp:
94-
dest.write_bytes(resp.read())
79+
pkg = importlib.resources.files('datadog_checks.downloader')
80+
dest.write_bytes((pkg / '1.root.json').read_bytes())
9581

9682
def _make_updater(self, metadata_dir: Path, target_dir: Path) -> Updater:
9783
return Updater(

datadog_checks_downloader/pyproject.toml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,9 @@ include = [
5555
include = [
5656
"/datadog_checks/downloader",
5757
]
58+
artifacts = [
59+
"/datadog_checks/downloader/1.root.json",
60+
]
5861
dev-mode-dirs = [
5962
".",
6063
]

0 commit comments

Comments
 (0)