root documents are cached locally forever

[barabo]

Checklist

• I added a descriptive title
• I searched open reports and couldn't find a duplicate

What happened?

When conda-content-trust is enabled, it attempts to download successive versions of X.root.json from the configured signing_metadata_url_base (which would be https://repo.anaconda.cloud/repo for many users), saving them to ${CONDA_PREFIX}/etc/X.root.json locally.

These cached files never expire! So, in the unlikely events that a root document must be rolled back or was published erroneously, the local copy would be retained - potentially later masking a fixing change.

Also, conda clean -a does not remove these files, as suggested in documentation (but I can't seem to find the link to that right now).

Conda Info

No response

Conda Config

No response

Conda list

No response

Additional Context

No response

[bhuwan-agarwal]

@jezdez any update on this? This is going to be a blocker for the upcoming changes in the key_mgr.

[jezdez]

@bhuwan-agarwal No update, the ticket description didn't say anything about this blocking something, the severity is purely an indicator of the issue quality, doesn't have a direct result in immediate action unless it's requested.

[chenghlee]

This is going to be a blocker for the upcoming changes in the key_mgr.

@bhuwan-agarwal: why would this be a blocker? (There's an argument to be made that we should never roll back a root key deployment, and in any case, there's already a workaround for this issues --- users manually remove the cached *.root.json.)

[LtDan33]

I would assume we would only ever roll forward if there was an issue?

[bhuwan-agarwal]

@chenghlee, @jezdez, I think the main thing to clarify is whether conda-content-trust caching the root document locally is the intended behavior or not. In order for a more accurate assessment of this issue, can we answer the following two questions definitively:

• Is the local persistence of root documents after clearing local cache an expected behavior?
• In case of any issues with a given root release, is the only recourse to create new versions with no rollbacks allowed?