Use assert to check for None values

This is done only for hinting 'mypy' that we have
ensured these values cannot be None.

'Bandit' raises warnings for assert usage in the code
but we are disabling them since we do not rely upon
'asserts' for any runtime checks but only for type checking.

Signed-off-by: Teodora Sechkova <tsechkova@vmware.com>

Author: sechkova

tuf/ngclient/_internal/trusted_metadata_set.py

@@ -317,6 +317,8 @@ def update_snapshot(self, data: bytes) -> None:
     def _check_final_snapshot(self) -> None:
         """Check snapshot expiry and version before targets is updated"""
 
+        assert self.snapshot is not None  # nosec
+        assert self.timestamp is not None  # nosec
         if self.snapshot.signed.is_expired(self.reference_time):
             raise exceptions.ExpiredMetadataError("snapshot.json is expired")
 

tuf/ngclient/updater.py

@@ -345,6 +345,7 @@ def _load_snapshot(self) -> None:
             # Local snapshot does not exist or is invalid: update from remote
             logger.debug("Failed to load local snapshot %s", e)
 
+            assert self._trusted_set.timestamp is not None  # nosec
             metainfo = self._trusted_set.timestamp.signed.meta["snapshot.json"]
             length = metainfo.length or self.config.snapshot_max_length
             version = None
@@ -365,6 +366,7 @@ def _load_targets(self, role: str, parent_role: str) -> None:
             # Local 'role' does not exist or is invalid: update from remote
             logger.debug("Failed to load local %s: %s", role, e)
 
+            assert self._trusted_set.snapshot is not None  # nosec
             metainfo = self._trusted_set.snapshot.signed.meta[f"{role}.json"]
             length = metainfo.length or self.config.targets_max_length
             version = None