An Auto-Updater That Doesn't Trust Its Download Server: minisign, Verify-Before-Parse and Rollback Protection

Remembering the highest verified version has a recovery problem when the thing that leaked is a signing key. Someone holding the primary key can sign a manifest for 99.0.0, and every client that checks during that window records it as highest seen, whether or not the user installs it. After that, the real fix, say 1.2.27 signed with the backup key, comes back as StaleManifest, so the release meant to retire the bad key can't reach the clients that saw the attack.

TUF calls this a fast-forward attack, and its client workflow deletes the stored timestamp and snapshot metadata when those keys are rotated. The small equivalent here would be to store the minisign key ID with highest_seen_version and keep one ratchet per key. A backup-signed release is then compared only with what the backup key has signed before, and the strictly-greater check against the running version still blocks a downgrade.

Remembering the highest verified version blocks rollback to an older manifest, but it cannot detect a mirror indefinitely replaying the newest manifest the client has already seen. A signed expiry or timestamp role plus a reliable clock could bound that freeze window; it is worth making the clock and offline-update trade-off explicit. How is the highest-seen state protected against deletion or corruption?