fix: add functionality to bump a version

cmd/tuf/app/add-delegation.go

@@ -185,9 +185,9 @@ func DelegationCmd(ctx context.Context, directory, name, path string, terminatin
 	if err != nil {
 		return err
 	}
-	signed, err := jsonMarshal(t)
+	signed, err := prepo.MarshalMetadata(t)
 	if err != nil {
 		return err
 	}
-	return setSignedMeta(store, "targets.json", &data.Signed{Signatures: sigs, Signed: signed})
+	return prepo.SetSignedMeta(store, "targets.json", &data.Signed{Signatures: sigs, Signed: signed})
 }

cmd/tuf/app/init.go

@@ -16,7 +16,6 @@
 package app
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"flag"
@@ -286,16 +285,8 @@ func InitCmd(ctx context.Context, directory, previous string,
 	return setMetaWithSigKeyIDs(store, "root.json", root, maps.Keys(allRootKeys))
 }
 
-func setSignedMeta(store tuf.LocalStore, role string, s *data.Signed) error {
-	b, err := jsonMarshal(s)
-	if err != nil {
-		return err
-	}
-	return store.SetMeta(role, b)
-}
-
 func setMetaWithSigKeyIDs(store tuf.LocalStore, role string, meta interface{}, keyIDs []string) error {
-	signed, err := jsonMarshal(meta)
+	signed, err := prepo.MarshalMetadata(meta)
 	if err != nil {
 		return err
 	}
@@ -310,7 +301,7 @@ func setMetaWithSigKeyIDs(store tuf.LocalStore, role string, meta interface{}, k
 
 	}
 
-	return setSignedMeta(store, role, &data.Signed{Signatures: emptySigs, Signed: signed})
+	return prepo.SetSignedMeta(store, role, &data.Signed{Signatures: emptySigs, Signed: signed})
 }
 
 func ClearEmptySignatures(store tuf.LocalStore, role string) error {
@@ -328,22 +319,7 @@ func ClearEmptySignatures(store tuf.LocalStore, role string) error {
 		sigs = append(sigs, signature)
 	}
 
-	return setSignedMeta(store, role, &data.Signed{Signatures: sigs, Signed: signedMeta.Signed})
-}
-
-func jsonMarshal(v interface{}) ([]byte, error) {
-	// We don't need to canonically encode the payload in the store.
-	b, err := json.Marshal(v)
-	if err != nil {
-		return nil, err
-	}
-
-	var out bytes.Buffer
-	if err := json.Indent(&out, b, "", "\t"); err != nil {
-		return nil, err
-	}
-
-	return out.Bytes(), nil
+	return prepo.SetSignedMeta(store, role, &data.Signed{Signatures: sigs, Signed: signedMeta.Signed})
 }
 
 func getKeysFromDir(dir string, deprecatedKeyFormat bool) ([]*data.PublicKey, error) {

cmd/tuf/app/sign.go

@@ -30,6 +30,7 @@ import (
 	csignature "github.com/sigstore/cosign/pkg/signature"
 	"github.com/sigstore/root-signing/pkg/keys"
 	"github.com/sigstore/root-signing/pkg/repo"
+	prepo "github.com/sigstore/root-signing/pkg/repo"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/options"
 	cjson "github.com/tent/canonical-json-go"
@@ -58,6 +59,7 @@ func Sign() *ffcli.Command {
 		// TODO(https://github.com/sigstore/root-signing/issues/381):
 		// This can be removed after v5 root-signing is complete.
 		addDeprecatedKeyFormat = flagset.Bool("add-deprecated", false, "adds the deprecated ecdsa key format to associate signatures")
+		bumpVersion            = flagset.Bool("bump-version", false, "bumps the version; useful for re-signing without changes")
 	)
 	flagset.Var(&roles, "roles", "role(s) to sign")
 	return &ffcli.Command{
@@ -84,7 +86,7 @@ func Sign() *ffcli.Command {
 			if err != nil {
 				return err
 			}
-			return SignCmd(ctx, *repository, roles, signer, *addDeprecatedKeyFormat)
+			return SignCmd(ctx, *repository, roles, signer, *bumpVersion, *addDeprecatedKeyFormat)
 		},
 	}
 }
@@ -138,14 +140,19 @@ func getSigner(ctx context.Context, sk bool, keyRef string) (signature.Signer, e
 }
 
 func SignCmd(ctx context.Context, directory string, roles []string, signer signature.Signer,
-	addDeprecatedKeyFormat bool) error {
+	bumpVersion bool, addDeprecatedKeyFormat bool) error {
 	store := tuf.FileSystemStore(directory, nil)
 
 	if err := checkMetaForRole(store, roles); err != nil {
 		return fmt.Errorf("signing pre-requisites failed: %w", err)
 	}
 
 	for _, name := range roles {
+		if bumpVersion {
+			if err := prepo.BumpMetadataVersion(store, name); err != nil {
+				return err
+			}
+		}
 		if err := SignMeta(ctx, store, name+".json", signer, addDeprecatedKeyFormat); err != nil {
 			return err
 		}
@@ -249,7 +256,7 @@ func SignMeta(ctx context.Context, store tuf.LocalStore, name string, signer sig
 			strings.Join(keyIDs, ", "), name, roleSigningKeys)
 	}
 
-	return setSignedMeta(store, name, &data.Signed{Signatures: sigs, Signed: s.Signed})
+	return prepo.SetSignedMeta(store, name, &data.Signed{Signatures: sigs, Signed: s.Signed})
 }
 
 // Pre-entries are defined when there are Signatures in the Signed metadata

pkg/repo/repo.go

@@ -16,6 +16,7 @@
 package repo
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -302,3 +303,55 @@ func UpdateRoleKeys(repo *tuf.Repo, store tuf.LocalStore, role string, keys []*d
 	}
 	return nil
 }
+
+func MarshalMetadata(v interface{}) ([]byte, error) {
+	// We don't need to canonically encode the payload in the store.
+	b, err := json.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+
+	var out bytes.Buffer
+	if err := json.Indent(&out, b, "", "\t"); err != nil {
+		return nil, err
+	}
+
+	return out.Bytes(), nil
+}
+
+func SetSignedMeta(store tuf.LocalStore, role string, s *data.Signed) error {
+	b, err := MarshalMetadata(s)
+	if err != nil {
+		return err
+	}
+	return store.SetMeta(role, b)
+}
+
+// BumpMetadataVersion increments the version of the manifest.
+// This ONLY handles targets types! The repo.SetRootVersion, repo.SetTargetsVersion,
+// or repo.SetSnapshotVersion, or repo.SetTimestampVersion handle top-level
+// metadata.
+func BumpMetadataVersion(store tuf.LocalStore, name string) error {
+	for _, topName := range []string{"root", "targets", "snapshot", "timestamp"} {
+		if name == topName {
+			return fmt.Errorf("unsupported metadata version bump %s", topName)
+		}
+	}
+	manifest := fmt.Sprintf("%s.json", name)
+	s, err := GetSignedMeta(store, manifest)
+	if err != nil {
+		return err
+	}
+	targets := &data.Targets{}
+	if err := json.Unmarshal(s.Signed, targets); err != nil {
+		return err
+	}
+	targets.Version++
+
+	signed, err := MarshalMetadata(targets)
+	if err != nil {
+		return err
+	}
+
+	return SetSignedMeta(store, manifest, &data.Signed{Signed: signed})
+}