CVE-2024-47534

CVE-2024-47534 affects the go-tuf Go TUF client. The root cause is incorrect delegation tracing: when targets delegate to A and B, and B delegates to C, the client may traverse B→C→A instead of A→B→C, due to the way GetRolesForTarget maps are handled in metadata.go. This can cause the client to t...