refresh-roots

Overview ¶

Command refresh-roots keeps the embedded sigstore trusted roots as fresh as possible.

For every instance declared in sigstore/sigstore-roots.json it fetches the current trusted_root.json over TUF (the very same path the runtime accessor uses, internal/tuf.GetRoot), validates that it parses, writes it to sigstore/roots/<id>.trusted_root.json and stamps that instance's "trusted-root-snapshot" with the current date.

It is idempotent: run twice on the same day against unchanged upstreams it produces byte-identical output. Run it from the repository root:

go run ./hack/refresh-roots