[riha-dev]

Updater.updateTimestamp returns as soon as the mirror serves a timestamp with the same version as the trusted one, so the freeze attack check from spec 5.4.4 never runs on the timestamp the update goes on with. updateMeta then sees an unchanged timestamp and reuses the cached snapshot and targets without checking their expires either. A mirror or stale CDN cache that keeps serving the last signed timestamp is accepted by any client with a populated cache, which keeps using its cached targets (including trusted_root.json) until root.json expires. A client with an empty cache rejects the same responses.

Check the trusted timestamp's expiry before the equal-version return, and check the cached snapshot and targets when the timestamp did not change. The checks live in Updater because it holds the update start time and decides which copy of each role is kept. python-tuf and go-tuf behave the same way: they keep the old timestamp on an equal version and fail the refresh once it, or the cached snapshot or targets, has expired. The new UpdaterTest cases cover the unchanged-mirror path for each role and fail on main. tuf-conformance v2.4.0 still passes and has no test for this case.