rust-tuf
rust-tuf copied to clipboard
Implement checking for snapshot rollback of targets and delegations
TUF-1.0.5 section 5.3.3.2 states:
3.3.2. The version number of the targets metadata file, and all delegated targets metadata files (if any), in the trusted snapshot metadata file, if any, MUST be less than or equal to its version number in the new snapshot metadata file. Furthermore, any targets metadata filename that was listed in the trusted snapshot metadata file, if any, MUST continue to be listed in the new snapshot metadata file. If any of these conditions are not met, discard the new snapshot metadadata file, abort the update cycle, and report the failure.
We need to extend Tuf to support this check.