Historical preview · now released · checked 2026-10-31

Trust-hardening preview

This former preview shipped in v0.18.0. See the current trust-root guide and upgrade guide. GitHub and PyPI publish v0.18.0.

Certificate transparency

Repeatable --ct-key FILE verifies an embedded Fulcio SCT offline against its log key, precertificate data, and certificate validity. --require-sct requires a CT key and makes that requirement explicit. These flags apply only to keyless attestations; existing behavior is unchanged without them.

Trusted-root files

--trusted-root FILE supplies Rekor, Fulcio, and CT roots with their validity windows. It cannot be combined with separate Rekor/Fulcio/CT key flags. CT logs require strict key-hash IDs; unsupported Rekor v2 logs are skipped because the supported v1 receipts cannot name them. If CT logs are present, an embedded SCT is required.

Explicit TUF updates

tine trust root update verifies root rotation thresholds, timestamp/snapshot/targets metadata, hashes, versions, expiry, and persisted rollback state. Bootstrap requires an independently trusted --root FILE; no TUF root is embedded. Nothing is fetched unless the operator runs the update.

The installed trusted_root.json becomes the default for keyless verification with no key file specified. Trust policies carry these published options. A weekly non-required live check exercises public Sigstore updates; the release gate does not depend on that network service.

Review the pinned source changelog and release status.