opentine v0.18.0: verify the evidence, own the trust

opentine v0.18.0 is published on GitHub and PyPI. It strengthens keyless run evidence with certificate-transparency checks, time-bounded Sigstore trusted roots, and an explicit TUF update workflow.

Check the certificate's transparency evidence

tine verify --attestation ... --ct-key FILE verifies an SCT embedded in a Fulcio leaf certificate. It checks the matching CT log key, precertificate data, issuer key hash, and timestamp inside the certificate's validity.

CT keys are repeatable; --require-sct makes the requirement explicit and needs a CT key. These options apply to keyless attestations. Existing verification stays unchanged when they are not selected.

Keep the roots together

tine verify result.tine --attestation result.sigstore.json --trusted-root trusted_root.json --cert-identity ci@example.com --cert-oidc-issuer https://token.actions.githubusercontent.com --json

A Sigstore trusted-root file supplies Rekor, Fulcio, and CT roots with their validity windows. When it lists CT logs, the certificate must carry a valid SCT. Separate Rekor/Fulcio/CT key flags cannot be mixed with the trusted-root option.

CT log identifiers remain strict key hashes. Rekor v2 tile logs are skipped because the supported v1 receipts cannot name them; their presence no longer makes an otherwise usable public root fail wholesale.

Update trust through an explicit operation

tine trust root update --root trusted-tuf-root.json

There is no embedded bootstrap root. The operator supplies an independently trusted TUF root for the first update. Root rotation thresholds, timestamp/snapshot/targets metadata, versions, hashes, lengths, expiry, and persisted rollback state are verified before installation.

The installed root becomes the default for keyless verification with no key file named. Nothing is fetched unless the operator runs an update. Named policies can carry trusted-root and SCT requirements while retaining their user-owned configuration boundary.

A weekly, non-required live Sigstore check helps detect upstream format changes. The release gate remains independent of that public service.

python -m pip install --upgrade "opentine==0.18.0"

Read the upgrade guide, trust-root reference, and policy guide. Existing CLI spellings and storage compatibility requirements remain unchanged.