Merge remote-tracking branch 'origin/main' into rekov2-client

Author: jku

.github/workflows/pin-requirements.yml

@@ -76,7 +76,10 @@ jobs:
           cache: "pip"
           cache-dependency-path: pyproject.toml
 
-      - run: pip install pip-tools
+      - name: Install dependencies
+        run: |
+          pip install "pip < 25.1" # workaround issue 1426
+          pip install pip-tools
 
       - name: Compute version from tag
         run: |

CHANGELOG.md

@@ -46,10 +46,6 @@ All versions prior to 0.9.0 are untracked.
   still required.
   [#1381](https://github.com/sigstore/sigstore-python/pull/1381)
 
-* Verify: Avoid hard failure if trusted root contains unsupported keytypes (as verification
-  may succeed without that key).
-  [#1424](https://github.com/sigstore/sigstore-python/pull/1424)
-
 * CI: Timestamp Authority tests use latest release, not latest tag, of
   [sigstore/timestamp-authority](https://github.com/sigstore/timestamp-authority)
   [#1377](https://github.com/sigstore/sigstore-python/pull/1377)
@@ -82,6 +78,13 @@ All versions prior to 0.9.0 are untracked.
     Use `SigningContext.from_trust_config()` instead.
     [#1363](https://github.com/sigstore/sigstore-python/pull/1363)
 
+## [3.6.3]
+
+### Fixed
+
+* Verify: Avoid hard failure if trusted root contains unsupported keytypes (as verification
+  may succeed without that key).
+  [#1425](https://github.com/sigstore/sigstore-python/pull/1425)
 
 ## [3.6.2]
 
@@ -683,7 +686,8 @@ This is a corrective release for [2.1.1].
 
 
 <!--Release URLs -->
-[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v3.6.2...HEAD
+[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v3.6.3...HEAD
+[3.6.3]: https://github.com/sigstore/sigstore-python/compare/v3.6.2...v3.6.3
 [3.6.2]: https://github.com/sigstore/sigstore-python/compare/v3.6.1...v3.6.2
 [3.6.1]: https://github.com/sigstore/sigstore-python/compare/v3.6.0...v3.6.1
 [3.6.0]: https://github.com/sigstore/sigstore-python/compare/v3.5.3...v3.6.0

install/requirements.in

@@ -1 +1 @@
-sigstore==3.6.2
+sigstore==3.6.3