From ffb835cd7efc6911af684d675b7e0c5ec239805d Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Tue, 1 Sep 2026 13:11:19 +0300 Subject: [PATCH 1/2] workflows: Test more recent releases Signed-off-by: Jussi Kukkonen --- .github/workflows/cross-version-verify.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cross-version-verify.yaml b/.github/workflows/cross-version-verify.yaml index d1c7a3656..3ad95a171 100644 --- a/.github/workflows/cross-version-verify.yaml +++ b/.github/workflows/cross-version-verify.yaml @@ -57,7 +57,7 @@ jobs: fail-fast: false # Don't cancel other jobs if one fails matrix: # hand crafted list of old versions we care about - version: [ 3.5.6, 3.6.7, 4.0.0, 4.1.0, 4.2.0 ] + version: [ 3.5.6, 3.6.7, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 ] env: [ staging, prod ] exclude: # exclude staging for versions with https://github.com/sigstore/sigstore-python/issues/1656 From 4c757963ef92e663d7a8b4999d8e6809e7964d03 Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Tue, 1 Sep 2026 13:12:29 +0300 Subject: [PATCH 2/2] pyproject: Add the securesystemslib extras we need This just brings in cryptography (which we already depend on) but also sets required version (currently 48). Signed-off-by: Jussi Kukkonen --- pyproject.toml | 1 + uv.lock | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/pyproject.toml b/pyproject.toml index 2028344f9..8bd5cc71f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -40,6 +40,7 @@ dependencies = [ "sigstore-models == 0.0.6", "sigstore-rekor-types == 0.0.18", "tuf >= 6, < 8", + "securesystemslib[crypto]", "platformdirs ~= 4.2", ] requires-python = ">=3.10" diff --git a/uv.lock b/uv.lock index 5ca48c51f..a24e503bb 100644 --- a/uv.lock +++ b/uv.lock @@ -1675,6 +1675,11 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/bd/29/1c560f46b3a95d8c508e1bd8c6d0bbf53c42d412ee7d19ec2a89ceced5b9/securesystemslib-1.3.1-py3-none-any.whl", hash = "sha256:2e5414bbdde33155a91805b295cbedc4ae3f12b48dccc63e1089093537f43c81", size = 871380, upload-time = "2025-09-26T13:36:54.851Z" }, ] +[package.optional-dependencies] +crypto = [ + { name = "cryptography" }, +] + [[package]] name = "setuptools" version = "83.0.0" @@ -1698,6 +1703,7 @@ dependencies = [ { name = "rfc3161-client" }, { name = "rfc8785" }, { name = "rich" }, + { name = "securesystemslib", extra = ["crypto"] }, { name = "sigstore-models" }, { name = "sigstore-rekor-types" }, { name = "tuf" }, @@ -1730,6 +1736,7 @@ requires-dist = [ { name = "rfc3161-client", specifier = ">=1.0.3,<1.1.0" }, { name = "rfc8785", specifier = "~=0.1.2" }, { name = "rich", specifier = ">=13,<16" }, + { name = "securesystemslib", extras = ["crypto"] }, { name = "sigstore-models", specifier = "==0.0.6" }, { name = "sigstore-rekor-types", specifier = "==0.0.18" }, { name = "tuf", specifier = ">=6,<8" },