tuf Updater: fix snapshot version rollback case by jku · Pull Request #1061 · sigstore/sigstore-java

@jku

The snapshot version listed in timestamp must never decrease
(except if timestamp keys are rotated but that in that case local timestamp
is not used at all).

This was a deviation from TUF specification but not a very serious one in
context: In sigstores TUF repository the Timestamp/snapshot keys are exposed
in the same environments so compromise in one means compromise for both
(because of this they are in fact the same key). So tricks like snapshot
version rollback are not that relevant.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>