Noticed that internal/fulcio/fulcioroots uses TUF... but does not use it to download trusted_root.json that contains the current trust material but instead seems to download the deprecated individual keys/cert files. This will break at some point.
This likely makes sense to fix when you upgrade from the old cosign version: see #537
Noticed that
internal/fulcio/fulciorootsuses TUF... but does not use it to downloadtrusted_root.jsonthat contains the current trust material but instead seems to download the deprecated individual keys/cert files. This will break at some point.This likely makes sense to fix when you upgrade from the old cosign version: see #537