opentine v0.18.1: reliable trust updates

v0.18.1 is a focused reliability release for the trust workflow introduced in v0.18.0. It fixes slow TUF fetches on broken IPv6 routes and expands the compatibility test corpus.

Root updates without the long stall

Previously, each repository request could spend its entire 30-second timeout on an unreachable IPv6 address before trying IPv4. Requests now try IPv4 first, with a five-second connection budget per address.

The changelog reports a refresh taking about a second instead of minutes in the affected scenario. That is not a universal latency guarantee: network conditions and repository availability still matter.

python -m pip install --upgrade "opentine==0.18.1"

# First update: supply an independently trusted bootstrap root
tine trust root update --root trusted-tuf-root.json

# Subsequent explicit updates use persisted trust state
tine trust root update

The trust boundary is unchanged. There is no embedded bootstrap root, and no implicit network refresh. TUF rotation thresholds, metadata hashes, expiry checks, and persisted rollback protection remain part of the workflow.

Compatibility backed by historical wheels

Golden fixtures now cover 27 published releases since v0.3.0, generated with their published wheels. The conformance suite contains 580 vectors, including 209 cases that must refuse input. The adapter contract retains one entry point with 36 operations.

Those are test-coverage facts, not a promise that every future format or arbitrary input will be accepted. Portable .tine v2 artifacts and the separate v3 repository format remain unchanged in this patch.

Keep the v0.18 trust tools

Certificate-transparency verification, time-bounded Sigstore trusted-root files, and named operator policies remain available. Read the trust-root guide for their keyless-attestation constraints and the v0.18 upgrade guide for rollout considerations.

The exact changes are recorded in the v0.18.1 changelog, with the release on GitHub and PyPI.