theupdateframework / rust-tuf / 29217804779

93%

Build Type

push

github

Committed by erickt

Commit Message

When updating timestamp, make sure we aren't rolling back snapshot

This implements [TUF-1.0.5 §5.2.2.2], which states:

> The version number of the targets metadata file, and all
> delegated targets metadata files (if any), in the trusted snapshot metadata
> file, if any, MUST be less than or equal to its version number in the new
> snapshot metadata file. Furthermore, any targets metadata filename that was
> listed in the trusted snapshot metadata file, if any, MUST continue to be
> listed in the new snapshot metadata file.  If any of these conditions are
> not met, discard the new snapshot metadadata file, abort the update cycle,
> and report the failure.

Furthermore, it adds three tests to:

* make sure rollbacks are prevented
* that trusted target roles cannot be removed in a normal update.
* that we can remove a target role with a root roll.

Fixes #294.

[TUF-1.0.5 §5.2.2.2]: https://github.com/theupdateframework/specification/blob/39c80de07/tuf-spec.md?plain=1#L1163

Coverage Stats

51 of 51 new or added lines in 1 file covered. (100.0%)

70 existing lines in 1 file now uncovered.

9765 of 10531 relevant lines covered (92.73%)

285.68 hits per line