Handle consistent targets same as legacy updater

The definition of consistent targets in the spec is ambiguous:
"consistent target files should be written to non-volatile storage
as digest.filename.ext"
Additionally, the specification describes consistent targets when the
client builds the download URL as follows:
"The filename is of the form HASH.FILENAME.EXT".
The issue is about how we interpreted those quotes.
The legacy updater has decided this means a target path "a/b" will
translate to a download url path "a/{HASH}.b".
The ngclient however translates the target path "a/b" to a download url
path "{HASH}.a/b".

We decided we want to follow the same approach taken from the legacy
updater and thus change how we construct the consistent targets.
Additionally, we want to make sure we test for cases when the TARGETPATH
is an empty string or points to a directory.

Signed-off-by: Martin Vrachev <[email protected]>

Author: MVrachev

tests/test_updater_with_simulator.py

@@ -82,7 +82,8 @@ def test_refresh(self):
     def test_targets(self):
         targets = {
             "targetpath": b"content",
-            "åäö": b"more content"
+            "åäö": b"more content",
+            "dir/targetpath": b"dir target content"
         }
 
         # Add targets to repository
@@ -110,8 +111,13 @@ def test_targets(self):
             with open(local_path, "rb") as f:
                 self.assertEqual(f.read(), content)
 
-        # TODO: run the same download tests for target paths like "dir/file2")
-        # This currently fails because issue #1576
+            if "/" in targetpath:
+                # assert local_path != targetpath because of the URL encoding
+                # make target_path absolute as local_path
+                target_path = os.path.join(self.targets_dir, targetpath)
+                self.assertNotEqual(target_path, local_path)
+
+
 
     def test_keys_and_signatures(self):
         """Example of the two trickiest test areas: keys and root updates"""

tuf/ngclient/updater.py

@@ -230,6 +230,8 @@ def download_target(
                 download URL. Default is the value provided in Updater()
 
         Raises:
+            ValueError: If target_base_url and self._target_base_url are
+                simultaniosly None.
             TODO: download-related errors
             TODO: file write errors
 
@@ -252,8 +254,9 @@ def download_target(
         consistent_snapshot = self._trusted_set.root.signed.consistent_snapshot
         if consistent_snapshot and self.config.prefix_targets_with_hash:
             hashes = list(targetinfo.hashes.values())
-            target_filepath = f"{hashes[0]}.{target_filepath}"
-        full_url = parse.urljoin(target_base_url, target_filepath)
+            dirname, sep, basename = target_filepath.rpartition("/")
+            target_filepath = f"{dirname}{sep}{hashes[0]}.{basename}"
+        full_url = f"{target_base_url}{target_filepath}"
 
         with self._fetcher.download_file(
             full_url, targetinfo.length