Yes, of course. But what if the hashes are None? For example, when download
the timestamp.txt

在 2013年8月6日星期二，Trishank Karthik Kuppusamy 写道：

> In tuf/download.py:
>
> > +
> > +  <Returns>
> > +    None.
> > +
> > +  """
> > +
> > +  # The length of downloading file obtained from server is larger than which
> > +  # obtained from metadata or default length. So it could be a endless data
> > +  # attack.
> > +  if reported_length is not None:
> > +    if reported_length != required_length:
> > +      if reported_length > required_length:
> > +        message = 'Incorrect length for '+url+'. The length reported by server is'+ \
> > +                  ' larger than expected. Expected '+str(required_length)+', got '+ \
> > +                  str(reported_length)+' bytes. It could be an endless data attack!'
> > +        raise tuf.DownloadError(message)
>
> Ok, so if we download a file where reported_length > required_length,
> what does that mean? It means that the server claims that the file is
> actually bigger than what signed metadata told us. There are a few reasons
> why this could happen: metadata is not in sync with the data; server is
> incorrectly reporting the Content-Length.
>
> That's fine. We go ahead and download the required_length of bytes
> anyway. If the hashes don't match, we would know, right?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/theupdateframework/tuf/pull/81/files#r5610047>
> .
>


-- 
yours sincerely
Yuyu Zheng

e-mail：yz1485@students.poly.edu