Communicate changes to client developers

[jku]

This issue documents the upcoming Sigstore staging TUF changes for client developers:

• The repository (https://tuf-repo-cdn.sigstage.dev/) will soon be produced by new software running in this git repository
• Staging will be a live repository (with changes at a similar frequency as the production TUF repository)
• Staging will uses signing keys similar to production TUF repository
• Everything Should Just Work: clients should not have disruptions
• However, the changed tooling means there are some small metadata changes that could have effects
  • metadata contains custom fields (that clients do not need to understand, but need include when producing canonical JSON)
  • metadata may contain empty signatures "sig": "" (for signers that have not signed this metadata)
  • artifact hashes will be using "sha256" only

The long term plan is for sigstore-conformance to test against staging (sigstore/sigstore-conformance#124)... but that may take a while. In the mean time:

• client developers can already make a preliminary test against the development URL if they want (https://sigstore.github.io/root-signing-staging/ in place of https://tuf-repo-cdn.sigstage.dev/)
• The plan is to deploy https://tuf-repo-cdn.sigstage.dev/ as soon as we are all set (#47)
• Once new staging is live, I will ping the "clients" slack channel and this issue and ask client devs to file issues in this repository if something isn't working

Once the new staging TUF is live, please test that your client works with it: Production TUF will follow with similar change some time after.

[jku]

Plan is to enable publishing the new staging today.

Blocker: #64

[jku]

The Sigstore staging TUF at https://tuf-repo-cdn.sigstage.dev/ is now deployed from this repository.

Please test and get in touch if something isn't working.

Future steps:

• make sigstore-conformance test staging as well (so clients get notified about upcoming breaking changes in Sigstore TUF, even if they are breaking by accident)
• start migrating the production TUF (https://github.com/sigstore/root-signing that publishes to https://tuf-repo-cdn.sigstore.dev/) to the same setup as well

[jku]

I think this is now handled