rust-tuf icon indicating copy to clipboard operation
rust-tuf copied to clipboard

Implement checking for timestamp rollback of snapshot

Open erickt opened this issue 5 years ago • 0 comments

TUF-1.0.5 added section 5.2.2.2:

2.2.2. The version number of the snapshot metadata file in the trusted timestamp metadata file, if any, MUST be less than or equal to its version number in the new timestamp metadata file. If not, discard the new timestamp metadata file, abort the update cycle, and report the failure.

We need to extend Tuf to support this check.

See https://github.com/theupdateframework/specification/pull/106 for more details.

erickt avatar Sep 17 '20 23:09 erickt