rust-tuf
rust-tuf copied to clipboard
Implement checking for timestamp rollback of snapshot
TUF-1.0.5 added section 5.2.2.2:
2.2.2. The version number of the snapshot metadata file in the trusted timestamp metadata file, if any, MUST be less than or equal to its version number in the new timestamp metadata file. If not, discard the new timestamp metadata file, abort the update cycle, and report the failure.
We need to extend Tuf to support this check.
See https://github.com/theupdateframework/specification/pull/106 for more details.