Don't check version-constraints when mirroring (#62)

Currently we check version-constraints when creating TUF clients for
mirroring. This is not right, and to be honest the version check
probably shouldn't even be at the TUF client level -- it's meant for
specifying the version-constraints of the _policy_ in the TUF repo.

Needed to fix
https://github.com/docker/tuf-staging/actions/runs/10998625087/job/30536959822

Author: jonnystoten

cmd/metadata.go

@@ -10,6 +10,7 @@ import (
 	"github.com/docker/attest/mirror"
 	"github.com/docker/attest/oci"
 	"github.com/docker/attest/tuf"
+	mirrortuf "github.com/docker/go-tuf-mirror/internal/tuf"
 	"github.com/docker/go-tuf-mirror/internal/util"
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/spf13/cobra"
@@ -82,7 +83,7 @@ func (o *metadataOptions) run(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return fmt.Errorf("failed to get root bytes: %w", err)
 	}
-	m, err := mirror.NewTUFMirror(cmd.Context(), root.Data, tufPath, o.source, o.targets, tuf.NewDefaultVersionChecker())
+	m, err := mirror.NewTUFMirror(cmd.Context(), root.Data, tufPath, o.source, o.targets, &mirrortuf.NullVersionChecker{})
 	if err != nil {
 		return fmt.Errorf("failed to create TUF mirror: %w", err)
 	}

cmd/targets.go

@@ -10,6 +10,7 @@ import (
 	"github.com/docker/attest/mirror"
 	"github.com/docker/attest/oci"
 	"github.com/docker/attest/tuf"
+	mirrortuf "github.com/docker/go-tuf-mirror/internal/tuf"
 	"github.com/docker/go-tuf-mirror/internal/util"
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/spf13/cobra"
@@ -97,7 +98,7 @@ func (o *targetsOptions) run(cmd *cobra.Command, args []string) error {
 		if err != nil {
 			return fmt.Errorf("failed to get root bytes: %w", err)
 		}
-		m, err = mirror.NewTUFMirror(cmd.Context(), root.Data, tufPath, o.metadata, o.source, tuf.NewDefaultVersionChecker())
+		m, err = mirror.NewTUFMirror(cmd.Context(), root.Data, tufPath, o.metadata, o.source, &mirrortuf.NullVersionChecker{})
 		if err != nil {
 			return fmt.Errorf("failed to create TUF mirror: %w", err)
 		}

internal/tuf/nullversionchecker.go

@@ -0,0 +1,11 @@
+package tuf
+
+import (
+	"github.com/docker/attest/tuf"
+)
+
+type NullVersionChecker struct{}
+
+func (*NullVersionChecker) CheckVersion(tuf.Downloader) error {
+	return nil
+}