build(deps): bump sigstore from 4.2.0 to 4.3.0 in the python-dependencies group

[dependabot]

Bumps the python-dependencies group with 1 update: sigstore.

Updates sigstore from 4.2.0 to 4.3.0

Release notes

Sourced from sigstore's releases.

v4.3.0

Added

• Issuer.identity_token accepts an optional redirect_port argument to accomodate OIDC providers that require pre-registered redirect URIs (#1029)

Fixed

• Fix ~60s keep-alive deadlock in browser-based OIDC authentication (#1693)
• Avoid over-using connections when signing many artifacts: Use one connection per thread (#1732)

Changed

• With Rekor v2 DSSE signing/verification now uses Hashedrekord log entries. This is based on Rekor v2 spec change: sigstore/architecture-docs#63 (#1776)
• sigstore is now compatible with cryptography 48 and tuf 7 (#1773)
• Embedded TUF metadata has been updated (#1785)

Changelog

Sourced from sigstore's changelog.

[4.3.0]

Added

• Issuer.identity_token accepts an optional redirect_port argument to accomodate OIDC providers that require pre-registered redirect URIs (#1029)

Fixed

• Fix ~60s keep-alive deadlock in browser-based OIDC authentication (#1693)
• Avoid over-using connections when signing many artifacts: Use one connection per thread (#1732)

Changed

• With Rekor v2 DSSE signing/verification now uses Hashedrekord log entries. This is based on Rekor v2 spec change: sigstore/architecture-docs#63 (#1776)
• sigstore is now compatible with cryptography 48 and tuf 7 (#1773)
• Embedded TUF metadata has been updated (#1785)

Commits

• 4baa76f Prepare 4.3.0 release (#1774)
• 3566ecd build(deps): bump sigstore/sigstore-conformance in the actions group (#1797)
• 05fcf60 Makefile: use uv run --locked everywhere (#1793)
• a5a9441 build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the actions g...
• 531d12e build(deps-dev): bump ruff from 0.15.13 to 0.15.14 (#1791)
• c62a99b build(deps): bump pyjwt from 2.12.1 to 2.13.0 (#1790)
• b90e55d Bump the ceiling on cryptography version (#1773)
• fb9f2c4 TUF: Update embedded roots (#1785)
• 603eeb3 Encode DSSE as hashedrekord for Rekor v2 (#1776)
• 9b4f5f9 build(deps-dev): bump ruff from 0.15.12 to 0.15.13 (#1786)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions