Closed jku closed 3 months ago
securesystemslib 1.0 and tuf 5.0 have released. sigstore is likely happening soon (need to wait for that one because of the common dependency on tuf & securesystemslib)
Bump to 3.1 makes sense. Any reason that depending on a minor version should be avoided?
Yeah bump to 3.1 makes sense.
There's an issue currently:
Metadata.signed_bytes
added in 3.1That PR has not moved because the new features still needed tweaking which happened in tuf 4.0... which is not usable because other reasons related to sigstore compat.
Options:
signed_bytes
: I believe that's the only accidentally used new featureI think the version bump makes sense
cc @kommendorkapten