Fix __hash__ crashing on unhashable dict attributes

[Sachith77]

Description

Follow-up to #2973, which fixed __hash__ for Role and DelegatedRole.

Same problem was still there in the other metadata classes: Signed, Root, MetaFile, Snapshot, Delegations, TargetFile, Targets, and Metadata. Their __hash__ implementations passed raw dictionaries into hash(), which throws TypeError: unhashable type: 'dict'.

Timestamp.__hash__ looked fine on its own, but still breaks because it inherits from Signed and MetaFile.

All these classes define __eq__, so they need a working __hash__ too if they're going to be used in sets or as dict keys. test_metadata_eq_.py covers equality for these classes but never tested hashing, which is probably why this slipped through.

Fix follows the same approach as #2973 — hash a subset of immutable fields instead of the raw dicts.

unrecognized_fields is left out since it can hold arbitrary nested JSON. Everything else I just converted to tuples.

Testing

• test_metadata_hash checks that for each affected class, hash() doesn't raise, equal objects produce equal hashes, and instances can be used as set members. This fails on develop with 8 subtest errors before the fix.
• test_metadata_hash_ignores_unrecognized_fields checks the deliberate exclusion of unrecognized_fields — objects that only differ in that field are unequal but can share a hash, which is fine given the data model.

[jku]

yeah I guessed the rest of them had issues after #2973... Left some questions in code.

[Sachith77]

Yeah, both are fair. hashes is just dict[str, str] so there was no real reason to drop it, I was being over-careful. And with len(), two snapshots with the same number of entries ended up with the same hash.

Used tuple(sorted(...)) in all four since a dict isn't hashable on its own, and the sort keeps it stable if the key order varies.

[jku]

I spent a bit more time and I think it's still not complete, details in code.

Unfortunately several cases will keep failing even with (what I think is) correct code as the securesystemslib hashing seems to still not be complete. I'm fine with either

• fixing Key and Signature hashing first in securesystemslib, then completing this
• Completing this PR (even if that means hashing Metadata objects fails until securesystemslib is fixed) -- just need to add some special case in tests

[Sachith77]

Thanks for the detailed review. I made the same assumption as before with the dictionaries , focused on making them hashable and initially overlooked that the values also need to be included. I've applied all the suggestions.

I added a runtime check in the tests so Root/Delegations/Metadata are skipped while Key and Signature aren't hashable, and will start running once the sslib update is available. I also tested it locally against sslib main, and those three tests pass there.

[jku]

I also tested it locally against sslib main, and those three tests pass there.

👍 thanks for testing