GHSA-846p-jg2w-w324

# Security Disclosure: Client DoS via malformed server response

## Summary

If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.

## Impact

Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.

## Workarounds

None currently.

## Affected code

The `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.