fix: abandon updates if timestamp.json isn't new

[znewman01]

Adds a new test for this case: if a client sees a new timestamp.json file with the same version as its current timestamp.json file, it should do nothing (no update, but also no error).

A few other tests were implicitly relying on the fact that the client did a full update each time, so they've been updated to commit a new timestamp.

This updates go-tuf for TUF specification v1.0.30 (fixes #321). The only substantive change was
theupdateframework/specification#209, which clarifies the intended behavior for updating metadata files.

Updates for other roles were already in compliance:

• Root metadata:

  go-tuf/client/client.go

  Line 258 in 13eff30

  // 5.3.3 Try downloading version nPlusOne of the root metadata file.

• Timestamp, checking snapshot version:

  go-tuf/client/client.go

  Line 751 in 13eff30

  if timestamp.Meta["snapshot.json"].Version < c.snapshotVer {

• Snapshot, must match version from timestamp:

  go-tuf/client/client.go

  Line 667 in 13eff30

  // 5.5.4 - Check against timestamp role's version

• Snapshot, no rollback of targets:

  go-tuf/client/client.go

  Line 685 in 13eff30

  if snapshot.Meta["targets.json"].Version < c.targetsVer {

• Targets:

  go-tuf/client/client.go

  Line 643 in 13eff30

  // 5.6.4 - Check against snapshot role's version

Signed-off-by: Zachary Newman [email protected]

---

Please fill in the fields below to submit a pull request. The more information that is provided, the better.

Fixes #369
Release Notes: go-tuf clients now only complete an update if the timestamp.json file is new, rather than completing the same update over and over.

Types of changes:

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Description of the changes being introduced by the pull request: See above

Please verify and check that the pull request fulfills the following requirements:

• Tests have been added for the bug fix or new feature
• Docs have been added for the bug fix or new feature: N/A

[joshuagl]

Great stuff, thanks.