compatibility: sigstore metadata expiry is incompatible

[jku]

trafficstars

https://github.com/sigstore/root-signing/blob/main/repository/repository/1.root.json

• expiry contains microseconds
• expiry contains a timezone offset

we don't consider this spec compliant and currently fail to load this metadata. Should file a bug on go-tuf I suppose?

In addition to this securesystemslib fails to load the ecdsa keys they use: #1859.

[jku]

cc @rdimitrov

[joshuagl]

There's some discussion about this in a go-tuf issue https://github.com/theupdateframework/go-tuf/issues/136

[jku]

:pray: current sigstore metadata works with python-tuf-ngclient ( boostrap from 5.root.json only). Thanks Asra and others who worked on this!

Now would be a good time to start working on a compliance test suite...