tuf Updater: fix snapshot version rollback case by jku · Pull Request #1061 · sigstore/sigstore-java
The snapshot version listed in timestamp must never decrease (except if timestamp keys are rotated but that in that case local timestamp is not used at all). This was a deviation from TUF specification but not a very serious one in context: In sigstores TUF repository the Timestamp/snapshot keys are exposed in the same environments so compromise in one means compromise for both (because of this they are in fact the same key). So tricks like snapshot version rollback are not that relevant. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>