Upgrade to v0.18

Terminal

python -m pip install --upgrade "opentine==0.18.0"
tine verify --help
tine trust root --help

v0.18.0 is published on GitHub and PyPI. Python 3.11–3.14, existing command spellings, and storage reader requirements remain supported. The new trust checks are opt-in; verification is unchanged without the new flags or a newly selected root.

Review keyless verification

Use repeatable --ct-key and --require-sct for embedded Fulcio SCT verification, or --trusted-root for Rekor/Fulcio/CT roots with validity windows. These options require keyless attestation evidence; key-signed attestations are refused. Trusted-root and separate key-file flags are mutually exclusive.

Bootstrap deliberately

The TUF updater has no embedded root. The first explicit update needs --root FILE from an independently trusted source. Once installed, the verified Sigstore root becomes a default for keyless verification with no named key file. Review user trust policies and cached roots before relying on that default.

Nothing refreshes over the network unless tine trust root update is run. The updater verifies expiry, rollback state, threshold signatures, metadata versions, lengths, and hashes.

See the trust-root guide, policy precedence, and storage compatibility. Release v0.17.1's Windows recorder/GC fixes remain included.