TUF specification has a new version - v1.0.31

[github-actions]

Hey, it seems there's a newer version of the TUF specification - v1.0.31

The version which theupdateframework/go-tuf states it supports is - v1.0.29

The following is a comparison of what changed between the two versions - Compare v1.0.29 to v1.0.31

Please review the newer version and address the changes.

[znewman01]

Only potentially relevant commit is this one: theupdateframework/specification@7b565c7

I'll give it a skim.

[znewman01]

Okay, we're good based on this code:

go-tuf/client/client.go

Lines 293 to 299 in 7f9beab

	// 5.3.5 Check for a rollback attack. Here, we check that nPlusOneRootMetadataSigned.version == nPlusOne.
	if nPlusOneRootMetadataSigned.Version != nPlusOne {
	return verify.ErrWrongVersion{
	Given: nPlusOneRootMetadataSigned.Version,
	Expected: nPlusOne,
	}
	}

It's covered in tests here:

go-tuf/client/client_test.go

Lines 444 to 448 in 7f9beab

	// Fails updating root to 2.root.json when the value of the version field inside it is 1 (rollback attack prevention).
	{"testdata/Published1Time_backwardRootVersion", verify.ErrWrongVersion(verify.ErrWrongVersion{Given: 1, Expected: 2}), map[string]int64{}},
	// Fails updating root to 2.root.json when the value of the version field inside it is 3 (rollforward attack prevention).
	{"testdata/Published3Times_keyrotated_forwardRootVersion", verify.ErrWrongVersion(verify.ErrWrongVersion{Given: 3, Expected: 2}), map[string]int64{}},
	// Fails updating when there is no local trusted root.

We should add more-specific unit tests, but that's already tracked in #286

Will close by updating the listed specification version.