Remove iso8601 dependency

I’ve been going through the tuf dependency chain with an eye on integrating tuf with pip: The issue with pip is that it’s a package manager so needs to vendor everything it needs – so being conservative with dependencies is a good idea. The good news is that tuf does not have many direct or indirect dependencies that would be a problem (good work!).

The one that possibly sticks out is “iso8601”. The module is currently used in two places:

• repository_tool: Metadata.expiration property getter uses it to return a datetime object
• updater.py: Updater::_ensure_not_expired()

I’m mostly interested in that last one. it’s used to compare the expiration stamp to current time and to format the error message:

    expires_datetime = iso8601.parse_date(expires)
    expires_timestamp = tuf.formats.datetime_to_unix_timestamp(expires_datetime)

    if expires_timestamp < current_time:
      message = 'Metadata '+repr(metadata_rolename)+' expired on ' + \
        expires_datetime.ctime() + ' (UTC).'
      logger.error(message)

      raise tuf.exceptions.ExpiredMetadataError(message)

I’m not familiar with date handling in python so my question is: Is this dependency valid or could this code be replaced with something that did not depend on iso8601?

[jku]

I’ve just reviewed the iso8601 test suite and have come to the conclusion that using the iso8601 module is in fact not compliant with the (spirit of the) tuf spec: current implementation allows for timestamps that I would not expect to work after reading the spec, such as “2006-10-20T15:34:56.123+02:30”.

The spec currently says:

Metadata date-time data follows the ISO 8601 standard. The expected format of the combined date and time string is “YYYY-MM-DDTHH:MM:SSZ”. Time is always in UTC, and the “Z” time zone designator is attached to indicate a zero UTC offset. An example date-time string is “1985-10-21T01:21:00Z”.

I think the paragraph is fairly clear but first sentence could be better: we want to support only this very specific format of the ISO8601 not the whole iso8601 spec.

As for the implementation, I think the helper idea is good. I don’t think the replace() call in the example is needed: the strptime format used does not allow for a timezone at all.

[joshuagl]

The dateutil usage in securesystemslib does not appear to be necessary, so I created a PR to remove it secure-systems-lab/securesystemslib#268