Bypass the short-lived embedded TUF root in sigstore/sigstore wheneve… - #827

Open

raacar wants to merge 3 commits into

sigstore:mainfrom

raacar:fix/avoid_embedded_certificate_when_local_sigstore

Commits on Jun 15, 2026

Bypass the short-lived embedded TUF root in sigstore/sigstore whenever a local sigstore-go trusted_root.json is available, and stop rejecting legitimate signatures on a redundant TSA-window check.
raacar
committed
The two GenTime == NotBefore and GenTime == NotAfter cases (formerly "maybe before/after", expected to error) now expect success — they're the inclusive-boundary cases. Added two new cases at NotBe…
raacar
committed
Added code that was untracked, causing tests to fail internal/sigstore/localcache and modifications to fulcioroots, gitsign, client. And ietf-cms/verify.go
raacar
committed