compatibility: sigstore metadata expiry is incompatible

[jku]

https://github.com/sigstore/root-signing/blob/main/repository/repository/1.root.json

• expiry contains microseconds
• expiry contains a timezone offset

we don't consider this spec compliant and currently fail to load this metadata. Should file a bug on go-tuf I suppose?

In addition to this securesystemslib fails to load the ecdsa keys they use: #1859.

[jku]

cc @rdimitrov

[joshuagl]

There's some discussion about this in a go-tuf issue theupdateframework/go-tuf#136

[jku]

🙏 current sigstore metadata works with python-tuf-ngclient ( boostrap from 5.root.json only). Thanks Asra and others who worked on this!

Now would be a good time to start working on a compliance test suite...