Device | Pitfall with set_local_trust on Device that is triggering a full DeviceChange and can overwrite other changes.

[BillCarsonFr]

There is a pitfall with Device and set_local_trust. If you keep a Device object around for some time then later on do a set_local_trust it is doing a full DeviceChanges that would overwrite changes that could have happens during that time (things like deleted olm_wedging_index withheld_code_sent)

Here

matrix-rust-sdk/crates/matrix-sdk-crypto/src/identities/device.rs

Lines 396 to 402 in 65b4223

	pub async fn set_local_trust(&self, trust_state: LocalTrust) -> StoreResult<()> {
	self.inner.set_trust_state(trust_state);
	let changes = Changes {
	devices: DeviceChanges { changed: vec![self.inner.clone()], ..Default::default() },
	..Default::default()
	};

Exposed in sdk here

matrix-rust-sdk/crates/matrix-sdk/src/encryption/identities/devices.rs

Line 548 in 65b4223

pub async fn set_local_trust(&self, trust_state: LocalTrust) -> Result<(), CryptoStoreError> {

[andybalaam]

Device updates from keys_query do not have cryptographically-meaningful effects, so this is not too serious, except that we might forget a new signature. This does not happen very often.