Support dynamic Sigstore trusted root update and caching during pub upgrade - #4877
Merged
mosuem merged 0 commit intoAug 24, 2026
Merged
Conversation
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 20, 2026 09:39
93bcb1b to
2f066ec
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
2 times, most recently
from
August 20, 2026 10:49
f1c2903 to
ce2b93a
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 20, 2026 11:35
ce2b93a to
b56c1a2
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
2 times, most recently
from
August 24, 2026 12:22
175f432 to
aff01ba
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 12:40
aff01ba to
1c41d10
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
2 times, most recently
from
August 24, 2026 12:52
2234016 to
df3f677
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 12:59
df3f677 to
b87100d
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 13:04
b87100d to
21a6c31
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 13:28
21a6c31 to
870e26e
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 15:05
870e26e to
66b0d74
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 15:40
66b0d74 to
0f59c5a
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
2 times, most recently
from
August 24, 2026 15:50
32638c4 to
7600ecb
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 15:53
7600ecb to
9909f86
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 15:57
9909f86 to
9994567
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 16:19
9994567 to
fe5e159
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 16:22
fe5e159 to
e052de4
Compare
mosuem
force-pushed
the
refresh-sigstore-trusted-root
branch
from
August 24, 2026 16:26
e052de4 to
854f6c8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PR (3 of 3 in stack, based on #4875):
sigstoreTrustedRootPathgetter toSystemCachepointing to$PUB_CACHE/sigstore/trusted_root.json.PubAttestationVerifier, passes cached trusted root path toloadTrustedRoot.UpgradeCommand, attempts to refresh the trusted root from Sigstore's TUF CDN before dependency resolution when online.