api/metadata input validation: hashes

Description of issue or feature request: Implement input validation for TargetFile and MetaFile hashes attribute.

Current behavior: The new api/metadata code does not perform any input validation on hashes. formats.py has a defined HASHDICT_SCHEMA that is not used in the new code.

Expected behavior: Define allowed values for hashes. Implement the verification in metadata.py

[MVrachev]

For algorithms (dict keys) I think we can rely onsecuresystemslib to give us information on which algorithms it supports. Considering we are using it to verify our signatures. Also, there aren’t many possible combinations here.

For hash(dict values) I will prefer if we do some validation during initialization and not pass this responsibility for this check to another function. So, I will prefer one of the first two options, I don’t have a strong opinion about which one.

[sechkova]

‘Hashes’ is a dictionary of the form:

{
          '<HASH ALGO 1>': '<TARGET FILE HASH 1>',
          '<HASH ALGO 2>': '<TARGET FILE HASH 2>',
          ...
}

Both keys and values could benefit a validation.

• Valid keys are hash algorithms supported by sslib
• Valid hash values could be defined by a regex or maybe just a ‘str’ is enough

Another possible option is to allow any values which will raise errors later during meta/target files hash verification step.

What must be strictly disallowed is an empty dictionary which may lead to skipping the mandatory hash verification check.