8 Pull requests merged by 2 people

• build(deps): update ruff requirement from <0.12.10 to <0.12.11

  #1520 merged Aug 22, 2025

• build(deps): bump github/codeql-action from 3.29.10 to 3.29.11 in the actions group

  #1517 merged Aug 22, 2025

• tests: Remove hacks that were needed before staging rekorv2

  #1519 merged Aug 22, 2025

• Workflow tweaks

  #1516 merged Aug 21, 2025

• rekor: Fix checkpoint signature lookup

  #1514 merged Aug 21, 2025

• Update embedded TUF root

  #1515 merged Aug 21, 2025

• build(deps): bump github/codeql-action from 3.29.9 to 3.29.10 in the actions group

  #1511 merged Aug 19, 2025

• Improve case of possible wrong instance on verify

  #1510 merged Aug 18, 2025

1 Pull request opened by 1 person

• workflows: Remove pip-tools workaround

  #1521 opened Aug 24, 2025

7 Issues closed by 2 people

• Handle public good SigningConfig once it's available

  #1388 closed Aug 24, 2025

• at least one signing test is hard coding a frozen rekor2 shard

  #1518 closed Aug 22, 2025

• conformance fails with pydantic errors

  #1503 closed Aug 21, 2025

• docs workflow should only try to upload at upstream project

  #1512 closed Aug 21, 2025

• issues with multiple checkpoint signatures

  #1513 closed Aug 21, 2025

• Embedded TUF root is not up-to-date

  #1473 closed Aug 21, 2025

• accidentally verifying with wrong sigstore instance looks confusing

  #1487 closed Aug 18, 2025

4 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Release 4.0 with rekorv2 changes

  #1465 commented on Aug 20, 2025 • 0 new comments

• revert workaround after pip-tools release

  #1428 commented on Aug 21, 2025 • 0 new comments

• cli: Add --rekor-version to sign arguments

  #1471 commented on Aug 20, 2025 • 0 new comments

• feat: expose ClientTrustConfig as a public class

  #1496 commented on Aug 20, 2025 • 0 new comments