Repository: theupdateframework/go-tuf
Pull request #198 (2021-12-10 23:06:38)

[Delegations prereq 8] Make snapshot manifest list dynamic, and remove root.json from snapshot
In https://github.com/theupdateframework/go-tuf/pull/175, we will update the implementation of `snapshotMetadata` to dynamically return delegated targets as well as `targets.json`, so we prepare for that we're putting the list of metadata files that snapshot pins into a function.

We are also opportunistically using this PR to remove `root.json` from snapshot.

coveralls: ## Pull Request Test Coverage Report for [Build 1565534432](https://coveralls.io/builds/44928260)

* **9** of **9**   **(100.0%)**  changed or added relevant lines in **1** file are covered.
* No unchanged relevant lines lost coverage.
* Overall coverage increased (+**0.05%**) to **70.641%**

---



|  Totals | [![Coverage Status](https://coveralls.io/builds/44928260/badge)](https://coveralls.io/builds/44928260) |
| :-- | --: |
| Change from base [Build 1565513894](https://coveralls.io/builds/44928131): |  0.05% |
| Covered Lines: | 2192 |
| Relevant Lines: | 3103 |

---
##### 💛  - [Coveralls](https://coveralls.io)


Patch:
diff --git a/client/client.go b/client/client.go
index 0459a1d..b4ea7f9 100644
--- a/client/client.go
+++ b/client/client.go
@@ -2,10 +2,10 @@ package client
 
 import (
 	"bytes"
+	"encoding/hex"
 	"encoding/json"
 	"io"
 	"io/ioutil"
-	"log"
 
 	"github.com/theupdateframework/go-tuf/data"
 	"github.com/theupdateframework/go-tuf/util"
@@ -192,10 +192,6 @@ func (c *Client) Update() (data.TargetFiles, error) {
 		return nil, err
 	}
 
-	if _, ok := snapshotMetas["root.json"]; ok {
-		log.Println("root pinning is not supported in Spec 1.0.19")
-	}
-
 	// If we don't have the targets.json, download it, determine updated
 	// targets and save targets.json in local storage
 	var updatedTargets data.TargetFiles
@@ -841,6 +837,29 @@ func (c *Client) Download(name string, dest Destination) (err error) {
 	return nil
 }
 
+func (c *Client) VerifyDigest(digest string, digestAlg string, length int64, path string) error {
+	localMeta, ok := c.targets[path]
+	if !ok {
+		return ErrUnknownTarget{Name: path, SnapshotVersion: c.snapshotVer}
+	}
+
+	actual := data.FileMeta{Length: length, Hashes: make(data.Hashes, 1)}
+	var err error
+	actual.Hashes[digestAlg], err = hex.DecodeString(digest)
+	if err != nil {
+		return err
+	}
+
+	if err := util.TargetFileMetaEqual(data.TargetFileMeta{FileMeta: actual}, localMeta); err != nil {
+		if e, ok := err.(util.ErrWrongLength); ok {
+			return ErrWrongSize{path, e.Actual, e.Expected}
+		}
+		return ErrDownloadFailed{path, err}
+	}
+
+	return nil
+}
+
 // Target returns the target metadata for a specific target if it
 // exists, searching from top-level level targets then through
 // all delegations. If it does not, ErrNotFound will be returned.
diff --git a/repo.go b/repo.go
index e4cec16..482cdf0 100644
--- a/repo.go
+++ b/repo.go
@@ -2,6 +2,7 @@ package tuf
 
 import (
 	"bytes"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -28,11 +29,6 @@ var topLevelMetadata = []string{
 	"timestamp.json",
 }
 
-var snapshotMetadata = []string{
-	"root.json",
-	"targets.json",
-}
-
 // TargetsWalkFunc is a function of a target path name and a target payload used to
 // execute some function on each staged target file. For example, it may normalize path
 // names and generate target file metadata with additional custom metadata.
@@ -703,6 +699,34 @@ func (r *Repo) AddTargets(paths []string, custom json.RawMessage) error {
 	return r.AddTargetsWithExpires(paths, custom, data.DefaultExpires("targets"))
 }
 
+func (r *Repo) AddTargetsWithDigest(digest string, digestAlg string, length int64, path string, custom json.RawMessage) error {
+	expires := data.DefaultExpires("targets")
+
+	// TODO: support delegated targets
+	t, err := r.topLevelTargets()
+	if err != nil {
+		return err
+	}
+
+	meta := data.FileMeta{Length: length, Hashes: make(data.Hashes, 1)}
+	meta.Hashes[digestAlg], err = hex.DecodeString(digest)
+	if err != nil {
+		return err
+	}
+
+	// If custom is provided, set custom, otherwise maintain existing custom
+	// metadata
+	if len(custom) > 0 {
+		meta.Custom = &custom
+	} else if t, ok := t.Targets[path]; ok {
+		meta.Custom = t.Custom
+	}
+
+	t.Targets[path] = data.TargetFileMeta{FileMeta: meta}
+
+	return r.writeTargetWithExpires(t, expires)
+}
+
 func (r *Repo) AddTargetWithExpires(path string, custom json.RawMessage, expires time.Time) error {
 	return r.AddTargetsWithExpires([]string{path}, custom, expires)
 }
@@ -742,12 +766,16 @@ func (r *Repo) AddTargetsWithExpires(paths []string, custom json.RawMessage, exp
 	}); err != nil {
 		return err
 	}
+	return r.writeTargetWithExpires(t, expires)
+}
+
+func (r *Repo) writeTargetWithExpires(t *data.Targets, expires time.Time) error {
 	t.Expires = expires.Round(time.Second)
 	if !r.local.FileIsStaged("targets.json") {
 		t.Version++
 	}
 
-	err = r.setTopLevelMeta("targets.json", t)
+	err := r.setTopLevelMeta("targets.json", t)
 	if err == nil {
 		fmt.Println("Added/staged targets:")
 		for k := range t.Targets {
@@ -830,6 +858,10 @@ func (r *Repo) Snapshot() error {
 	return r.SnapshotWithExpires(data.DefaultExpires("snapshot"))
 }
 
+func (r *Repo) snapshotMetadata() []string {
+	return []string{"targets.json"}
+}
+
 func (r *Repo) SnapshotWithExpires(expires time.Time) error {
 	if !validExpires(expires) {
 		return ErrInvalidExpires{expires}
@@ -844,12 +876,12 @@ func (r *Repo) SnapshotWithExpires(expires time.Time) error {
 		return err
 	}
 
-	for _, name := range snapshotMetadata {
-		if err := r.verifySignature(name, db); err != nil {
+	for _, metaName := range r.snapshotMetadata() {
+		if err := r.verifySignature(metaName, db); err != nil {
 			return err
 		}
 		var err error
-		snapshot.Meta[name], err = r.snapshotFileMeta(name)
+		snapshot.Meta[metaName], err = r.snapshotFileMeta(metaName)
 		if err != nil {
 			return err
 		}
@@ -931,9 +963,6 @@ func (r *Repo) fileHashes() (map[string]data.Hashes, error) {
 	if err != nil {
 		return nil, err
 	}
-	if m, ok := snapshot.Meta["root.json"]; ok {
-		hashes["root.json"] = m.Hashes
-	}
 	if m, ok := snapshot.Meta["targets.json"]; ok {
 		hashes["targets.json"] = m.Hashes
 	}
@@ -974,7 +1003,7 @@ func (r *Repo) Commit() error {
 	if err != nil {
 		return err
 	}
-	for _, name := range snapshotMetadata {
+	for _, name := range r.snapshotMetadata() {
 		expected, ok := snapshot.Meta[name]
 		if !ok {
 			return fmt.Errorf("tuf: snapshot.json missing hash for %s", name)


Test patch:
diff --git a/client/client_test.go b/client/client_test.go
index 5cbaf44..c0be244 100644
--- a/client/client_test.go
+++ b/client/client_test.go
@@ -1178,3 +1178,21 @@ func generateRepoFS(c *C, dir string, files map[string][]byte, consistentSnapsho
 	c.Assert(repo.Commit(), IsNil)
 	return repo
 }
+
+func (s *ClientSuite) TestVerifyDigest(c *C) {
+	digest := "sha256:bc11b176a293bb341a0f2d0d226f52e7fcebd186a7c4dfca5fc64f305f06b94c"
+	hash := "bc11b176a293bb341a0f2d0d226f52e7fcebd186a7c4dfca5fc64f305f06b94c"
+	size := int64(42)
+
+	c.Assert(s.repo.AddTargetsWithDigest(hash, "sha256", size, digest, nil), IsNil)
+	c.Assert(s.repo.Snapshot(), IsNil)
+	c.Assert(s.repo.Timestamp(), IsNil)
+	c.Assert(s.repo.Commit(), IsNil)
+	s.syncRemote(c)
+
+	client := s.newClient(c)
+	_, err := client.Update()
+	c.Assert(err, IsNil)
+
+	c.Assert(client.VerifyDigest(hash, "sha256", size, digest), IsNil)
+}
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/0/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-false/0/repository/snapshot.json
index 88e7271..58cecb2 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/0/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/0/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "ead7e8f3a5717ef8316d36f13f870fa70c484a451ced93342b6cd8d52d91b9f49d88278c34b8fab14f6d127f9701e3f272d479794795f5bffc364bf3a441cb08"
+			"sig": "3f24a81d61a8f1fbe2bf310a9d8263c7b3a5fc87524b92e00a100ce6d8e0f742c0ef05b017234b0d08c9cf4da4591deb65e6f76340afad722b3db1b25d2e0203"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "3645d16128d9f60fe1e8966685940256a1a6ef66fddb07c6134f886e5c96c8f6eecdbd5be27bd59202d252d3c8bd2e0bf960a66c5f7cb9a40eeac3fafadf2b8d"
-				},
-				"length": 2178,
-				"version": 1
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "e0dd9a3833d117cd7bb6fdaae8923d5bda0661cb242be067813bfec3114d83943230b8bb7fcbf093a15d5840f1ecd969f44d3df13e2045d3fb7d22903fbc1bf5"
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/0/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-false/0/repository/timestamp.json
index 05fa217..32382a3 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/0/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/0/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "f21f0edf928c8683ad5751ee7e79cbc3eb8c340ae418d93bcda1710c4a8ad0c858576b0d662db20128db2eabf2d4cec1b9babfc71e4171e501981a11f5c6d10f"
+			"sig": "cc163b290f68c6d41fbc7ca01a30416a43a5ee7652d2f99aff3c6ef01e5c2fa9d5f2caf0e745abeee3baa277ddfe43ac636149963cf085686345addc9e000301"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "f4c7e7bc04b386d303f23579ff32f9380831c0ca993974c7e2a40e6ee0eb51f392e315f09cf807a8c09d1b5a0a30bca27b81736d9522af2fd951dd8413eec4a5"
+					"sha512": "973d23a7e47e1003cd4f8c0e431b080171408e488084fe736b664433d9be76e1f1048ea76607c1f485f1dcb23ce2b4980257431c39cee0fddcc53559997cd565"
 				},
-				"length": 847,
+				"length": 617,
 				"version": 1
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/1/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-false/1/repository/snapshot.json
index 5e5d1e0..c8e5b3c 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/1/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/1/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "f832b8fd3e3a2ea65e35d8fe11861d9e252bef6c1a1775e39b4453d93314e0fc6c1b81b819af93ecd1433f707d06e026794e1dd3eccb1f5df5ed99dc3f13d30f"
+			"sig": "bded36f9992b8eb9444a276b397db2ce5f06a8be1273d7f84391b2a098778522a1c49185b2fc858aa99bc69fe820f2444bc8e5077f447ddcf42515c3a7026e0a"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "6b79dd15ae5aed0b96b5eb6226b27ba9b77f33bdac90a8da9b749120d312cd0240bd254cb8569daa777a7668edfee80681ee988f57416586bf1f7b04eefa4dc0"
-				},
-				"length": 2408,
-				"version": 2
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "8672c435a53519972738fada6ed3b7fa37b3ea42b4fa1e436b774e697a8d696d9efbeb6c590a6e16dec0a5e7f789da82ea59a68fae63f343340d1549a075ab1b"
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/1/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-false/1/repository/timestamp.json
index e6dcc70..42b04d4 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/1/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/1/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "5543ad32130a134921cf82d44575ad4b72a276297d6f8eafca116476d7e62b397e75e596f485517afb6c0a74e92f8ff96e1d24a1a341f8c68ceff06363386d07"
+			"sig": "8ab93c7453677374d1483c495b49d80128b589ca80c1f3e7806bb3c40bd8be793c6df492ce68b2bcf5d50af73fdf7694b0484093b31577720898d6882ae97d0f"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "d5ca4e4060b044075d38132891de10ba7ed9024f0a709674bd76b8c6270afabc16da2a449f5fd8740aebcca7c9828eb7fb28c917aa290a0cf1fc9c0daed879e7"
+					"sha512": "957e34523e34c2316a9fd02744162834382101796efca153e35028eb1e3fe970427d4e60e375300d1ac92e1c0a8ec74a1b5575a29d337b3454083a76cb922959"
 				},
-				"length": 847,
+				"length": 617,
 				"version": 2
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/2/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-false/2/repository/snapshot.json
index dfbfc84..772b23e 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/2/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/2/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "3840c3f286934c59194392a1f481df9c25676d9f0921d2cc5a283a540e663f8755754ff86d14175b0d7818aaf69cf1870c2779a974e32651e79de93b5b858507"
+			"sig": "94a60aaddf390953b997b783bab689a2cbaf66610b4dee5645ef858480f709b61afefc5eb21c6131aa5d3e2248eccebe77a7b4a8462f6f8f7964680085053903"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "b72aba523da68c23ac4e1e992894aa888a8c2ce947b7a615e9382e999594053b46e83198d68606d686b8868526a346279fcb73e6800b82a1e5ca0be184ccc5cb"
-				},
-				"length": 2178,
-				"version": 3
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "b103f5cd1d68e0b5f7b96af03a27cf971460977976cff0b1d1371dcce6d45ef78e183fa26bf886f3864e84b8ddbbfc1bab7bd0e2be180ad82ed26f22a8e9b68b"
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/2/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-false/2/repository/timestamp.json
index 13b8632..d5a05d7 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/2/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/2/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "77047b8a1d8221726b7df9d0fba92b495bcef861c1a06fe5a0ab5c579c595cda9ee546e28657e34a2b84747381ed5a557c7e273e05b97aa1e2eb429c2e1adf09"
+			"sig": "e431037f03bb3e323aa6d9f97533883a0d111698a17cd7eb7843961fa4b15a12a98a8a6cac377df934a9303d3765cc5314f59a160ffe11a32e76c18c27b0180f"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "3a27aa26ff6e341bf45f8237208583a1cbad65c88b19531b17d1f33eb4aaf7533f0ae1c263746101f285a608ec54c6330878c6ae3b331595ee6cc8b90c53a025"
+					"sha512": "49d07f15210a34a0b2bf51e2d349b243bba68800796a6f7031adaa14a86da0f3aa96098c46c6f55330fb71a424a6658cdf09683287f72f9082302e9be3aec1ef"
 				},
-				"length": 847,
+				"length": 617,
 				"version": 3
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/3/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-false/3/repository/snapshot.json
index 8d40592..8634000 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/3/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/3/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "5d310cc0b9cf6bf9c15b3d35020676b41dad6ae75405ec61cd299a697397fa4140c8718da6f0303708dd49e71d5f3702dae32289d1d7e34890073f90367bf109"
+			"sig": "bb6acd05cd4328a69a227ec24f3f241e3b692dfa04301b3ec682c808f143c94bed361ac5215800189f1b415a05ee1bf8534d452dab8548abe514582b91d0f308"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "8a9faf25965186fd6f131ba4d7c81c77c814e3ca7d18add76f952ab2ef3fa5aa8600a3511e784aff6156626a1e856b48d0bb085b93b5c3b30f24d2f56c4b303d"
-				},
-				"length": 2178,
-				"version": 4
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "75cc15d5a7c20656e37ece0a339434922fb489cf79f8ddf6a11d8c2a797ba1c7c51da0efaf335b31f9185c1eb9a5bbd074e16d412983a104e3bd33877eeb54c3"
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/3/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-false/3/repository/timestamp.json
index 70ffa07..0b5d5f7 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/3/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/3/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "92dede82d29dc862dbcd8f263880c1ed4140e54859feb2a985ea7efd95c040f443aa1057e2d91ddc6f7dc6618b9d6828e3744a681f658effd1f79f2989fcfa01"
+			"sig": "40e97ae18e413a3b44f2f1fb19c0ab57303fb39e950a38954a845f4ba1185bae2314e20c1dc5f157f60106c50e546e1d3469fb0b4cf6675810798f84f22cd001"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "1e7a837c1f6cf3f3a9bdf31869cc6fd6e146cba5065c438702d3225e8c0a4fef3d33148c8b41a1f86a15925c2032f7007d918c01794a3885d24801fa6a925904"
+					"sha512": "e55cb3fd889a759eaad70713f44d226a3b9b55b0e934fb6a1588832661c553d7f1e0cd6a2dfffeccabb5312dc9cf11ea88f34afbabd6fb715742ba60eb62756c"
 				},
-				"length": 848,
+				"length": 618,
 				"version": 4
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/4/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-false/4/repository/snapshot.json
index d460379..a47b7a6 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/4/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/4/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "b7da47fb77166cf71ed690476858ac830534e9528230c6cf9c76ca3f1821377c7036ca1e9aeffe4bf6ad178b99e5bb1cb65c4c175ec38c6f8e63f2d802be0a02"
+			"sig": "8ce62f94026a58e31a875017e0d10806e19e9541469330cdbfcd9ebfa5f0c317c7eb203256d114307d018400521add578bd2a11c85b5328af3e4efd471b92307"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "2446f097fb62a5dc304044b981e3933ae72c050a01199d79d59a91fbbb22a6283b093e8c71c8d812a62dbe5e02be97e61a85a0c1ff1aa5f4323462b27d843a19"
-				},
-				"length": 2178,
-				"version": 5
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "6832a32afe35bb07557081f3a935296cde39c39f6bca65bd068c337743b570818ff6c04a968a40b83228b46d214b44528719babfa3314658df36d4b21b0757ae"
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/4/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-false/4/repository/timestamp.json
index 7a98924..9100ddd 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/4/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/4/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "a8eaf6de5aecfd0a72b60295b1e1cd12f349079ebcbbb63dbe7072f162e85315",
-			"sig": "5b4df3ec23ea00d0fb1bea862d4b1e9666cf2c4d3c9a7b2d9f4df30ba56efe096ac6b9d5969e64f0c8b1883f990e12d17ed4d024aa68a1714913c5aabfbb0504"
+			"sig": "36fcb1d9c0e69fe2cd472d97835077b30340da0a326d8d20e844f6a1a84fba439c1662150e029032756b98cd9062686216a77a52b78c6641cd57e8f597d1380b"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "9ceab6e28e292fe87c94348762a7ba428929b6fbce3161ddb9b64fb139047973f1a1a0a58c861b6ea58e72f9e576ffcffc9b8da7f613e9cc29145dd7f5819768"
+					"sha512": "1a984612b0f1657b0a6974bf91e9b33c71a84709a6b36aa76dda4aaea1d132fdd3ef5fd777433a31908bec1f1a39984f9dcc72c3ddbf6b8ed92a7c779d080702"
 				},
-				"length": 848,
+				"length": 618,
 				"version": 5
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/5/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-false/5/repository/snapshot.json
index 791dc12..8e43024 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/5/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/5/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "bcf2c68335b1488f103828970d5b077c09009071defea99484dbdb7c4aea1c3d20a3086071d14fc153781693dbbadca55b8d31e6f3af9738c2b56af22d3f1903"
+			"sig": "7ed4b5c650c534154241ee575862730940ecdc61daa4dbbae167aefa2fe2ab47a6dcbccd099ab15630c6ebfd6acdfbacd89f30a6186c791b58a8dc0769bea405"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "2446f097fb62a5dc304044b981e3933ae72c050a01199d79d59a91fbbb22a6283b093e8c71c8d812a62dbe5e02be97e61a85a0c1ff1aa5f4323462b27d843a19"
-				},
-				"length": 2178,
-				"version": 5
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "97c2b46ccae4c2338d99819425239796c6647bf242ac64f13ec9347ec38fd8c6a5470756c079e1aaa23a013a8a720440f3128bd6c99f3c9f32492dd829726eee"
diff --git a/client/testdata/go-tuf/consistent-snapshot-false/5/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-false/5/repository/timestamp.json
index d0de0a3..2c619eb 100644
--- a/client/testdata/go-tuf/consistent-snapshot-false/5/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-false/5/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "a8eaf6de5aecfd0a72b60295b1e1cd12f349079ebcbbb63dbe7072f162e85315",
-			"sig": "87187a6d32aec086baf0cd0b15d9bf86735bb5397ee3f465794aef908ec47d33bb4d3a834d8c1d1d9b5c6d18b649549995712ba1f9b688184ffb26944b2bcd04"
+			"sig": "b90b0eaa68d6fbd0fda91dc5c9c27b5ad33665c4cb92e9dfa06742ba71870cb7fcc72d373970f35525c60523a16bae9720d6964da84f579f50480d7f6b27dc01"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "ddbc5e4ece52ff8c0e9ac079c757a050f80c8997694d7e04516f12346e31b8b34d323a1efea5ec021e2e10a721058bebc5f8980743e6a52df869705c0683cf2e"
+					"sha512": "69fe654899c63eedc38d481b56030c560967d00a5e709d536b89de7d166945bce2d5c91737a7b54eb058fccb11c2f8ea300c2529c94263a1f6bcadddfb709cc7"
 				},
-				"length": 848,
+				"length": 618,
 				"version": 6
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/0/repository/1.snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/0/repository/1.snapshot.json
index d0239f1..58cecb2 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/0/repository/1.snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/0/repository/1.snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "6813463556f5297c0cb33d417b974cbb2c6017b904728233a93776802befacf9cade0c95abcce9600e469b8c5820f22ef07b965bd4f59519f75621a72e33950e"
+			"sig": "3f24a81d61a8f1fbe2bf310a9d8263c7b3a5fc87524b92e00a100ce6d8e0f742c0ef05b017234b0d08c9cf4da4591deb65e6f76340afad722b3db1b25d2e0203"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "c51dcd7824d429552f6f9acbb9cb3de3aa89696e382c213cc85938f4f3676d3d9b4831dcdbb3c086873050629cc085614c3edaf11f5c3ddde17a92aa247c4b20"
-				},
-				"length": 2177,
-				"version": 1
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "e0dd9a3833d117cd7bb6fdaae8923d5bda0661cb242be067813bfec3114d83943230b8bb7fcbf093a15d5840f1ecd969f44d3df13e2045d3fb7d22903fbc1bf5"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/0/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/0/repository/snapshot.json
index d0239f1..58cecb2 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/0/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/0/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "6813463556f5297c0cb33d417b974cbb2c6017b904728233a93776802befacf9cade0c95abcce9600e469b8c5820f22ef07b965bd4f59519f75621a72e33950e"
+			"sig": "3f24a81d61a8f1fbe2bf310a9d8263c7b3a5fc87524b92e00a100ce6d8e0f742c0ef05b017234b0d08c9cf4da4591deb65e6f76340afad722b3db1b25d2e0203"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "c51dcd7824d429552f6f9acbb9cb3de3aa89696e382c213cc85938f4f3676d3d9b4831dcdbb3c086873050629cc085614c3edaf11f5c3ddde17a92aa247c4b20"
-				},
-				"length": 2177,
-				"version": 1
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "e0dd9a3833d117cd7bb6fdaae8923d5bda0661cb242be067813bfec3114d83943230b8bb7fcbf093a15d5840f1ecd969f44d3df13e2045d3fb7d22903fbc1bf5"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/0/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-true/0/repository/timestamp.json
index 6c539db..32382a3 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/0/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/0/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "77c9f3881607266b0fbd6cbef1714e0acef5f55bd6cfbf21751e3891ced9e29c1fc6b145f850a9a4202baa15936880e01a9949a7b5eb4cefe000cf64b389c500"
+			"sig": "cc163b290f68c6d41fbc7ca01a30416a43a5ee7652d2f99aff3c6ef01e5c2fa9d5f2caf0e745abeee3baa277ddfe43ac636149963cf085686345addc9e000301"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "1e6d2300378eb7f5759f5d0ea98ea2dcb813cf9e8a5b35920e22f338da66e883a5cb53678039ada440c6f75752fdc356e4e0d05bbff639634bc578a6f71c3a62"
+					"sha512": "973d23a7e47e1003cd4f8c0e431b080171408e488084fe736b664433d9be76e1f1048ea76607c1f485f1dcb23ce2b4980257431c39cee0fddcc53559997cd565"
 				},
-				"length": 847,
+				"length": 617,
 				"version": 1
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/1/repository/2.snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/1/repository/2.snapshot.json
index 4687c89..c8e5b3c 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/1/repository/2.snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/1/repository/2.snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "a9aa74e87f6ee1719d0c2cb3a37c2ff63bee3648bff572377b9169833012ed50b6d5a4604e668e200600ed6ef7c622e998e44580d4358aa638ab767e5de90509"
+			"sig": "bded36f9992b8eb9444a276b397db2ce5f06a8be1273d7f84391b2a098778522a1c49185b2fc858aa99bc69fe820f2444bc8e5077f447ddcf42515c3a7026e0a"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "51cd60db1c77e80b7d4553bff37eba869eb7ff9e3eb2726f6e550f4209ca8bde123a74f04cd42b0ac3a34af92f32e313ff8d5b64488f3b46c4c4fc4b836fc003"
-				},
-				"length": 2407,
-				"version": 2
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "8672c435a53519972738fada6ed3b7fa37b3ea42b4fa1e436b774e697a8d696d9efbeb6c590a6e16dec0a5e7f789da82ea59a68fae63f343340d1549a075ab1b"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/1/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/1/repository/snapshot.json
index 4687c89..c8e5b3c 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/1/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/1/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "a9aa74e87f6ee1719d0c2cb3a37c2ff63bee3648bff572377b9169833012ed50b6d5a4604e668e200600ed6ef7c622e998e44580d4358aa638ab767e5de90509"
+			"sig": "bded36f9992b8eb9444a276b397db2ce5f06a8be1273d7f84391b2a098778522a1c49185b2fc858aa99bc69fe820f2444bc8e5077f447ddcf42515c3a7026e0a"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "51cd60db1c77e80b7d4553bff37eba869eb7ff9e3eb2726f6e550f4209ca8bde123a74f04cd42b0ac3a34af92f32e313ff8d5b64488f3b46c4c4fc4b836fc003"
-				},
-				"length": 2407,
-				"version": 2
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "8672c435a53519972738fada6ed3b7fa37b3ea42b4fa1e436b774e697a8d696d9efbeb6c590a6e16dec0a5e7f789da82ea59a68fae63f343340d1549a075ab1b"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/1/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-true/1/repository/timestamp.json
index cf0241e..42b04d4 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/1/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/1/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "ace63f55631ff695d7ad960b4f40cf6013732f76edcb945e89798c21304df43c03c0f0e6e322dba35d488c517de5681318600813ccedb3f166f6ceb4f462930f"
+			"sig": "8ab93c7453677374d1483c495b49d80128b589ca80c1f3e7806bb3c40bd8be793c6df492ce68b2bcf5d50af73fdf7694b0484093b31577720898d6882ae97d0f"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "08a4fe01b9da9d07909d8ec02d2ea870b67fcc816751e56c61a8aebc587f051003f4b8a77c268f2a97b79997f7cbf836855e8638fc1df6c5df54ab7b49b2c671"
+					"sha512": "957e34523e34c2316a9fd02744162834382101796efca153e35028eb1e3fe970427d4e60e375300d1ac92e1c0a8ec74a1b5575a29d337b3454083a76cb922959"
 				},
-				"length": 847,
+				"length": 617,
 				"version": 2
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/2/repository/3.snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/2/repository/3.snapshot.json
index e7957f9..772b23e 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/2/repository/3.snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/2/repository/3.snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "dd586784e6b6963bf9a5901e7c80eecb77fe0cddd33b553e227869337d52a8e36130f59973410aca5bb2caefcd13057e08b499bdfd720b22efd62fd995d2e309"
+			"sig": "94a60aaddf390953b997b783bab689a2cbaf66610b4dee5645ef858480f709b61afefc5eb21c6131aa5d3e2248eccebe77a7b4a8462f6f8f7964680085053903"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "0f9a84fb34265274d9f68403c486b95e5fb27c38aad5252e22cfaf977a10c2cf780c1bee0ffa8bbfd350b835c608798ccfd8abb203034389194a353fe54ec486"
-				},
-				"length": 2177,
-				"version": 3
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "b103f5cd1d68e0b5f7b96af03a27cf971460977976cff0b1d1371dcce6d45ef78e183fa26bf886f3864e84b8ddbbfc1bab7bd0e2be180ad82ed26f22a8e9b68b"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/2/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/2/repository/snapshot.json
index e7957f9..772b23e 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/2/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/2/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "289e5a9e71afd7909326aa4caea92f7557ee0e2283d8c31f0c3401ce67248a45",
-			"sig": "dd586784e6b6963bf9a5901e7c80eecb77fe0cddd33b553e227869337d52a8e36130f59973410aca5bb2caefcd13057e08b499bdfd720b22efd62fd995d2e309"
+			"sig": "94a60aaddf390953b997b783bab689a2cbaf66610b4dee5645ef858480f709b61afefc5eb21c6131aa5d3e2248eccebe77a7b4a8462f6f8f7964680085053903"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "0f9a84fb34265274d9f68403c486b95e5fb27c38aad5252e22cfaf977a10c2cf780c1bee0ffa8bbfd350b835c608798ccfd8abb203034389194a353fe54ec486"
-				},
-				"length": 2177,
-				"version": 3
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "b103f5cd1d68e0b5f7b96af03a27cf971460977976cff0b1d1371dcce6d45ef78e183fa26bf886f3864e84b8ddbbfc1bab7bd0e2be180ad82ed26f22a8e9b68b"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/2/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-true/2/repository/timestamp.json
index 1c42c60..d5a05d7 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/2/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/2/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "1060f67b6bec92d00fb357b6858ff059e091bf3a2a95a254902fba6be9e4b1677777c5665e82dc405d1877eeb6c08ad8333638f156a544a77591e0e81327f303"
+			"sig": "e431037f03bb3e323aa6d9f97533883a0d111698a17cd7eb7843961fa4b15a12a98a8a6cac377df934a9303d3765cc5314f59a160ffe11a32e76c18c27b0180f"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "49fd64f5351893d11f51f7b84b48b12b3b2e96ac5a73a1cdedb453ef7cfa6786deb8401ebedc71a7261879b740ef7eb5e37707ac7fcdedc4393b9322f828f2f8"
+					"sha512": "49d07f15210a34a0b2bf51e2d349b243bba68800796a6f7031adaa14a86da0f3aa96098c46c6f55330fb71a424a6658cdf09683287f72f9082302e9be3aec1ef"
 				},
-				"length": 847,
+				"length": 617,
 				"version": 3
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/3/repository/4.snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/3/repository/4.snapshot.json
index 12c4da7..8634000 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/3/repository/4.snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/3/repository/4.snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "8ff1cc44d0cf82291f63cb8b4baa1b1f3f2080f29dea7dd9b08c4be0a14412dc9afa7f823bfc2af5d3514049e522f19588be3f433fb936da0e16884d2f8d3601"
+			"sig": "bb6acd05cd4328a69a227ec24f3f241e3b692dfa04301b3ec682c808f143c94bed361ac5215800189f1b415a05ee1bf8534d452dab8548abe514582b91d0f308"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "d99e7074aaec64f9b9747815bc695bda95b4c7a27ae9b0ec807f02cb36c3af5126198a2bdfb03a691913082eedcc809d4b6dd4afbb013936be02357f51f6313c"
-				},
-				"length": 2177,
-				"version": 4
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "75cc15d5a7c20656e37ece0a339434922fb489cf79f8ddf6a11d8c2a797ba1c7c51da0efaf335b31f9185c1eb9a5bbd074e16d412983a104e3bd33877eeb54c3"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/3/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/3/repository/snapshot.json
index 12c4da7..8634000 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/3/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/3/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "8ff1cc44d0cf82291f63cb8b4baa1b1f3f2080f29dea7dd9b08c4be0a14412dc9afa7f823bfc2af5d3514049e522f19588be3f433fb936da0e16884d2f8d3601"
+			"sig": "bb6acd05cd4328a69a227ec24f3f241e3b692dfa04301b3ec682c808f143c94bed361ac5215800189f1b415a05ee1bf8534d452dab8548abe514582b91d0f308"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "d99e7074aaec64f9b9747815bc695bda95b4c7a27ae9b0ec807f02cb36c3af5126198a2bdfb03a691913082eedcc809d4b6dd4afbb013936be02357f51f6313c"
-				},
-				"length": 2177,
-				"version": 4
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "75cc15d5a7c20656e37ece0a339434922fb489cf79f8ddf6a11d8c2a797ba1c7c51da0efaf335b31f9185c1eb9a5bbd074e16d412983a104e3bd33877eeb54c3"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/3/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-true/3/repository/timestamp.json
index 04bae5e..0b5d5f7 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/3/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/3/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "aa3255b4e8e17e566d2bdbea0e5842978f9fa1d2fa9ec76ae76b146164acbfc8",
-			"sig": "739949ce0e5fc4c154ec6e14a970ffc4f247288d14258c0165168a983cd232cf6b5390376d1189287e39de32d6524d4b6f6337174a53cb93a5fdfafe169ce201"
+			"sig": "40e97ae18e413a3b44f2f1fb19c0ab57303fb39e950a38954a845f4ba1185bae2314e20c1dc5f157f60106c50e546e1d3469fb0b4cf6675810798f84f22cd001"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "7b3740e1c7207537f8f16d2172c5ea7ca3decc788c65855ef5343fac69fc92a20d46d785e6bf689e977503165241af4b8882f943ae02022306ef0d3a91cd825f"
+					"sha512": "e55cb3fd889a759eaad70713f44d226a3b9b55b0e934fb6a1588832661c553d7f1e0cd6a2dfffeccabb5312dc9cf11ea88f34afbabd6fb715742ba60eb62756c"
 				},
-				"length": 848,
+				"length": 618,
 				"version": 4
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/4/repository/5.snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/4/repository/5.snapshot.json
index c646a7f..a47b7a6 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/4/repository/5.snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/4/repository/5.snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "cc836021c11c5ee44f9f343ce41f63766a9dfd8e4c3faaf58dc491235297b7408a43854ba2e3f6ecfc985d0f850b54c472b7b10a9db0a6fcaa69edc9db839d00"
+			"sig": "8ce62f94026a58e31a875017e0d10806e19e9541469330cdbfcd9ebfa5f0c317c7eb203256d114307d018400521add578bd2a11c85b5328af3e4efd471b92307"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "520ac0efdb3539bc82380a5bf1dc759de3f823896f3762e4f351fff3a8d647f1534ca6281c5c3a7f69c280a62e2f9ae83121f0c88597cd78b0b1ce2ae9a79fad"
-				},
-				"length": 2177,
-				"version": 5
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "6832a32afe35bb07557081f3a935296cde39c39f6bca65bd068c337743b570818ff6c04a968a40b83228b46d214b44528719babfa3314658df36d4b21b0757ae"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/4/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/4/repository/snapshot.json
index c646a7f..a47b7a6 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/4/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/4/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "cc836021c11c5ee44f9f343ce41f63766a9dfd8e4c3faaf58dc491235297b7408a43854ba2e3f6ecfc985d0f850b54c472b7b10a9db0a6fcaa69edc9db839d00"
+			"sig": "8ce62f94026a58e31a875017e0d10806e19e9541469330cdbfcd9ebfa5f0c317c7eb203256d114307d018400521add578bd2a11c85b5328af3e4efd471b92307"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "520ac0efdb3539bc82380a5bf1dc759de3f823896f3762e4f351fff3a8d647f1534ca6281c5c3a7f69c280a62e2f9ae83121f0c88597cd78b0b1ce2ae9a79fad"
-				},
-				"length": 2177,
-				"version": 5
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "6832a32afe35bb07557081f3a935296cde39c39f6bca65bd068c337743b570818ff6c04a968a40b83228b46d214b44528719babfa3314658df36d4b21b0757ae"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/4/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-true/4/repository/timestamp.json
index 69c4645..9100ddd 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/4/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/4/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "a8eaf6de5aecfd0a72b60295b1e1cd12f349079ebcbbb63dbe7072f162e85315",
-			"sig": "8dfecf93852c99731f81f9e3a34157591ce8f0e1012561b55fe63aa7914847aa7748bed775a89a6736ead746bfb4f578a60f5349126208af7052bc02ea2ca500"
+			"sig": "36fcb1d9c0e69fe2cd472d97835077b30340da0a326d8d20e844f6a1a84fba439c1662150e029032756b98cd9062686216a77a52b78c6641cd57e8f597d1380b"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "f4aca6f10fc10646768cca2fb2d58557d6ba7baea954c8d911ff800311974681e52cfe50fc150b86bb224f1ca22ee53c9fb74ca8d55441ddb67e3261e2b2ca3f"
+					"sha512": "1a984612b0f1657b0a6974bf91e9b33c71a84709a6b36aa76dda4aaea1d132fdd3ef5fd777433a31908bec1f1a39984f9dcc72c3ddbf6b8ed92a7c779d080702"
 				},
-				"length": 848,
+				"length": 618,
 				"version": 5
 			}
 		},
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/5/repository/6.snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/5/repository/6.snapshot.json
index da1c95d..8e43024 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/5/repository/6.snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/5/repository/6.snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "a32d2d190e9088327da8b56f758d7edfe103985e0616d8f3e0f30a7d9d646394648a2614ebbeb7c66dbca56011ea9fb9dc8eba1d2a2931a65829f63989461d07"
+			"sig": "7ed4b5c650c534154241ee575862730940ecdc61daa4dbbae167aefa2fe2ab47a6dcbccd099ab15630c6ebfd6acdfbacd89f30a6186c791b58a8dc0769bea405"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "520ac0efdb3539bc82380a5bf1dc759de3f823896f3762e4f351fff3a8d647f1534ca6281c5c3a7f69c280a62e2f9ae83121f0c88597cd78b0b1ce2ae9a79fad"
-				},
-				"length": 2177,
-				"version": 5
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "97c2b46ccae4c2338d99819425239796c6647bf242ac64f13ec9347ec38fd8c6a5470756c079e1aaa23a013a8a720440f3128bd6c99f3c9f32492dd829726eee"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/5/repository/snapshot.json b/client/testdata/go-tuf/consistent-snapshot-true/5/repository/snapshot.json
index da1c95d..8e43024 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/5/repository/snapshot.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/5/repository/snapshot.json
@@ -2,20 +2,13 @@
 	"signatures": [
 		{
 			"keyid": "b096bc2d67080cec22e6c0bbaa69cfd9d714b9e9ad847d255f950b2728855fef",
-			"sig": "a32d2d190e9088327da8b56f758d7edfe103985e0616d8f3e0f30a7d9d646394648a2614ebbeb7c66dbca56011ea9fb9dc8eba1d2a2931a65829f63989461d07"
+			"sig": "7ed4b5c650c534154241ee575862730940ecdc61daa4dbbae167aefa2fe2ab47a6dcbccd099ab15630c6ebfd6acdfbacd89f30a6186c791b58a8dc0769bea405"
 		}
 	],
 	"signed": {
 		"_type": "snapshot",
 		"expires": "2100-01-01T00:00:00Z",
 		"meta": {
-			"root.json": {
-				"hashes": {
-					"sha512": "520ac0efdb3539bc82380a5bf1dc759de3f823896f3762e4f351fff3a8d647f1534ca6281c5c3a7f69c280a62e2f9ae83121f0c88597cd78b0b1ce2ae9a79fad"
-				},
-				"length": 2177,
-				"version": 5
-			},
 			"targets.json": {
 				"hashes": {
 					"sha512": "97c2b46ccae4c2338d99819425239796c6647bf242ac64f13ec9347ec38fd8c6a5470756c079e1aaa23a013a8a720440f3128bd6c99f3c9f32492dd829726eee"
diff --git a/client/testdata/go-tuf/consistent-snapshot-true/5/repository/timestamp.json b/client/testdata/go-tuf/consistent-snapshot-true/5/repository/timestamp.json
index d0f9686..2c619eb 100644
--- a/client/testdata/go-tuf/consistent-snapshot-true/5/repository/timestamp.json
+++ b/client/testdata/go-tuf/consistent-snapshot-true/5/repository/timestamp.json
@@ -2,7 +2,7 @@
 	"signatures": [
 		{
 			"keyid": "a8eaf6de5aecfd0a72b60295b1e1cd12f349079ebcbbb63dbe7072f162e85315",
-			"sig": "0aad2933e303b4b85dd680061b4b617a3833f35ad8a0e65aa3909879d73022342ebaaa885c7c45c5c305a6ab726f0ce255beb64af12c3ee81823ded8c135de04"
+			"sig": "b90b0eaa68d6fbd0fda91dc5c9c27b5ad33665c4cb92e9dfa06742ba71870cb7fcc72d373970f35525c60523a16bae9720d6964da84f579f50480d7f6b27dc01"
 		}
 	],
 	"signed": {
@@ -11,9 +11,9 @@
 		"meta": {
 			"snapshot.json": {
 				"hashes": {
-					"sha512": "3510250ffbff04da4ad538411dc465fe771d2133716cd9e3eb1ca51f93fc83d2770f4e23573e781a96e4a0720d3e29a829343a0583c55586b3dfab35bac42c5c"
+					"sha512": "69fe654899c63eedc38d481b56030c560967d00a5e709d536b89de7d166945bce2d5c91737a7b54eb058fccb11c2f8ea300c2529c94263a1f6bcadddfb709cc7"
 				},
-				"length": 848,
+				"length": 618,
 				"version": 6
 			}
 		},
diff --git a/repo_test.go b/repo_test.go
index f378aa8..1e46147 100644
--- a/repo_test.go
+++ b/repo_test.go
@@ -3,6 +3,7 @@ package tuf
 import (
 	"crypto"
 	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -713,7 +714,7 @@ func (rs *RepoSuite) TestCommit(c *C) {
 	// commit with an invalid root hash in snapshot.json due to new key creation
 	genKey(c, r, "targets")
 	c.Assert(r.Sign("targets.json"), IsNil)
-	c.Assert(r.Commit(), DeepEquals, errors.New("tuf: invalid root.json in snapshot.json: wrong length, expected 1740 got 2046"))
+	c.Assert(r.Commit(), DeepEquals, errors.New("tuf: invalid targets.json in snapshot.json: wrong length, expected 511 got 725"))
 
 	// commit with an invalid targets hash in snapshot.json
 	c.Assert(r.Snapshot(), IsNil)
@@ -849,7 +850,6 @@ func (t *tmpDir) assertHashedFilesExist(path string, hashes data.Hashes) {
 }
 
 func (t *tmpDir) assertHashedFilesNotExist(path string, hashes data.Hashes) {
-	t.c.Assert(len(hashes) > 0, Equals, true)
 	for _, path := range util.HashedPaths(path, hashes) {
 		t.assertNotExist(path)
 	}
@@ -1037,6 +1037,9 @@ func (rs *RepoSuite) TestConsistentSnapshot(c *C) {
 	// root.json, targets.json and snapshot.json should exist at both versioned and unversioned paths
 	for _, path := range []string{"root.json", "targets.json", "snapshot.json"} {
 		repoPath := filepath.Join("repository", path)
+		if path != "root.json" {
+			c.Assert(len(hashes[path]) > 0, Equals, true)
+		}
 		tmp.assertHashedFilesNotExist(repoPath, hashes[path])
 		tmp.assertVersionedFileExist(repoPath, versions[path])
 		tmp.assertExists(repoPath)
@@ -1074,6 +1077,9 @@ func (rs *RepoSuite) TestConsistentSnapshot(c *C) {
 	// root.json, targets.json and snapshot.json should exist at both versioned and unversioned paths
 	for _, path := range []string{"root.json", "targets.json", "snapshot.json"} {
 		repoPath := filepath.Join("repository", path)
+		if path != "root.json" {
+			c.Assert(len(hashes[path]) > 0, Equals, true)
+		}
 		tmp.assertHashedFilesNotExist(repoPath, hashes[path])
 		tmp.assertVersionedFileExist(repoPath, versions[path])
 		tmp.assertExists(repoPath)
@@ -1180,9 +1186,8 @@ func (rs *RepoSuite) TestExpiresAndVersion(c *C) {
 	c.Assert(snapshot.Expires.Unix(), Equals, expires.Round(time.Second).Unix())
 	c.Assert(snapshot.Version, Equals, 6)
 
-	root, err = r.root()
-	c.Assert(err, IsNil)
-	c.Assert(snapshot.Meta["root.json"].Version, Equals, root.Version)
+	_, snapshotHasRoot := snapshot.Meta["root.json"]
+	c.Assert(snapshotHasRoot, Equals, false)
 	c.Assert(snapshot.Meta["targets.json"].Version, Equals, targets.Version)
 
 	c.Assert(r.Snapshot(), IsNil)
@@ -1242,7 +1247,6 @@ func (rs *RepoSuite) TestHashAlgorithm(c *C) {
 		c.Assert(err, IsNil)
 		for name, file := range map[string]data.FileMeta{
 			"foo.txt":       targets.Targets["foo.txt"].FileMeta,
-			"root.json":     snapshot.Meta["root.json"].FileMeta,
 			"targets.json":  snapshot.Meta["targets.json"].FileMeta,
 			"snapshot.json": timestamp.Meta["snapshot.json"].FileMeta,
 		} {
@@ -1795,3 +1799,34 @@ func (rs *RepoSuite) TestBadAddOrUpdateSignatures(c *C) {
 	}
 	checkSigIDs("root.json")
 }
+
+func (rs *RepoSuite) TestSignDigest(c *C) {
+	files := map[string][]byte{"foo.txt": []byte("foo")}
+	local := MemoryStore(make(map[string]json.RawMessage), files)
+	r, err := NewRepo(local)
+	c.Assert(err, IsNil)
+
+	genKey(c, r, "root")
+	genKey(c, r, "targets")
+	genKey(c, r, "snapshot")
+	genKey(c, r, "timestamp")
+
+	digest := "sha256:bc11b176a293bb341a0f2d0d226f52e7fcebd186a7c4dfca5fc64f305f06b94c"
+	hash := "bc11b176a293bb341a0f2d0d226f52e7fcebd186a7c4dfca5fc64f305f06b94c"
+	size := int64(42)
+
+	c.Assert(r.AddTargetsWithDigest(hash, "sha256", size, digest, nil), IsNil)
+	c.Assert(r.Snapshot(), IsNil)
+	c.Assert(r.Timestamp(), IsNil)
+	c.Assert(r.Commit(), IsNil)
+
+	digest_bytes, err := hex.DecodeString("bc11b176a293bb341a0f2d0d226f52e7fcebd186a7c4dfca5fc64f305f06b94c")
+	hex_digest_bytes := data.HexBytes(digest_bytes)
+	c.Assert(err, IsNil)
+
+	targets, err := r.topLevelTargets()
+	c.Assert(err, IsNil)
+	c.Assert(targets.Targets["sha256:bc11b176a293bb341a0f2d0d226f52e7fcebd186a7c4dfca5fc64f305f06b94c"].FileMeta.Length, Equals, size)
+	c.Assert(targets.Targets["sha256:bc11b176a293bb341a0f2d0d226f52e7fcebd186a7c4dfca5fc64f305f06b94c"].FileMeta.Hashes["sha256"], DeepEquals, hex_digest_bytes)
+
+}