Implement verification by a threshold of keys

Description of issue or feature request: A verification of signed metadata by a threshold of keys is needed both for client and repository.

Metadata already has vanilla one-signature verify and could potentially be the right location for this implementation. See https://github.com/theupdateframework/tuf/pull/1060#issuecomment-660056376 for thoughts about that distinction.

[joshuagl]

(Apologies for the brevity of this drive-by comment)

I think delegator verifies the delegated is the right approach (I do not like delegated verifies itself with info from delegator, options 2 & 3 in the original breakdown).

verify_delegate_with_threshold() in https://github.com/theupdateframework/tuf/compare/develop...jku:verify_with_threshold looks like a good starting point (at first glance it’s missing at least an optional Signer parameter).

[jku]

So the problem space is this:

• Root contains keys and thresholds for top level metadata
• delegating (targets) roles contain keys and thresholds for their delegated roles
• The “metadata controller” (client code or some repository tool) wants to verify all metadata using the correct keys and thresholds from the delegating role in a way that makes it clear what is happening
• “key uniqueness” wrt threshold needs to be upheld

Some options I see are (examples for a hypothetical client that wants to verify a timestamp file it has just downloaded):

• Root and Targets provide a function that verifies their delegates (note that this one turns the verifier/verifiee around – root verifies timestamp instead of timestamp verifying itself with data from root):

  root.signed.verify_delegate_with_threshold("timestamp", unverified_metadata)
  

• Metadata provides a way to verify itself and the delegating roles provide an easy way to get actual securesystemlib keys for a specific role

  keys = root.signed.get_keys("timestamp") # returns list of sslib key dict
  threshold = root.signed.get_threshold("timestamp")
  unverified_metadata.verify_with_threshold(keys, threshold)
  

• Metadata provides a way to verify itself and knows how to transform keyids to sslib keys

  keyids = root.signed.roles["timestamp"]["keyids"]
  threshold = root.signed.roles["timestamp"]["threshold"]
  unverified_metadata.verify_with_threshold(keyids, threshold)
  

(editing to add a fourth option)

• Metadata verifies that delegate is signed by correct threshold of keys:

  md.verify_delegate_with_threshold("timestamp", unverified_metadata)
  

This looks nice but does mean the function will have to check that self.signed is a Root or Targets…