Repository: sigstore/cosign
Pull request #3183 (2023-08-11 16:09:12)

chore(deps): bump github.com/theupdateframework/go-tuf from 0.5.2 to 0.6.1
Bumps [github.com/theupdateframework/go-tuf](https://github.com/theupdateframework/go-tuf) from 0.5.2 to 0.6.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/theupdateframework/go-tuf/releases">github.com/theupdateframework/go-tuf's releases</a>.</em></p>
<blockquote>
<h2>v0.6.1</h2>
<h2>Changelog</h2>
<h3>Bug fixes</h3>
<ul>
<li>ca0c316673ca2482fa188b36e44c3b49d4a8fd10: fix: fail to load deprecated ecdsa verifier (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/541">#541</a>) (<a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a>)</li>
</ul>
<h3>Others</h3>
<ul>
<li>8efd6cdb12ba7c28d10ede9fd00ba708ef71fa68: test: add python-tuf v3.0.0 support (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/515">#515</a>) (<a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a>)</li>
<li>7b85661d635d4be0a4add2336549141d45715c52: chore: add govulncheck and bump Go to 1.20 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/523">#523</a>) (<a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a>)</li>
<li>4e4f7f3c2772bf637d0ff9c524ddda5e6dd8dc79: chore(deps): bump actions/setup-python from 4.6.1 to 4.7.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/519">#519</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>ad706edfd9d11977f71277ceddcaebd79b606dff: chore(deps): bump golang.org/x/crypto from 0.11.0 to 0.12.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/539">#539</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
</ul>
<h2>v0.6.0</h2>
<h2>Changelog</h2>
<h3>Breaking changes</h3>
<ul>
<li>9774d7980aaec85ebcc7eaf8bd6d6e7c6747d2a3: feat!: add deprecating message for the encrypted package (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/521">#521</a>) (<a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>6aa3072403d1ee7e4030f3c7c9a0e2a22e194fc0: feat: increase scrypt parameters (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/470">#470</a>) (<a href="https://github.com/Zenithar"><code>@​Zenithar</code></a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>5a019c3b0722884ecd77b0923b74e135427ef949: fix: golangci-lint failures when tested against Go 1.20 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/457">#457</a>) (<a href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a>)</li>
<li>6b93a5ad22c270245b218c295f51b24e543c19b8: fix: sign-payload shouldn't recanonicalize payload (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/479">#479</a>) (<a href="https://github.com/znewman01"><code>@​znewman01</code></a>)</li>
<li>2adcfe74e69d474d298a991d9643bed13da055d7: fix: Update the ecdsa key type to the latest spec (1.0.32). (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/508">#508</a>) (<a href="https://github.com/kommendorkapten"><code>@​kommendorkapten</code></a>)</li>
</ul>
<h3>Others</h3>
<ul>
<li>2cea368d2bf2a7d4ea0ea368d26373ea2f977727: chore(deps): bump goreleaser/goreleaser-action from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/453">#453</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>f0771105d2d374b71fb6a0b21bd70bbdcbdd4234: chore(deps): bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/451">#451</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>0cd000c650894a80b4a5201e71f202812b8eae2f: chore(deps): bump arnested/go-version-action from 1.1.6 to 1.1.7 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/454">#454</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>fab805a8e00b5520c09855385b32761f41b67a6f: chore(deps): bump amannn/action-semantic-pull-request from 5.0.2 to 5.1.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/458">#458</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>96a25a4f027707d283030a0b1b0948c4a86865a3: chore(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/466">#466</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>075e800bd914b11d90b78eb3e352d88d24da29c2: chore(deps): bump golang.org/x/term from 0.0.0-20210927222741-03fcf44c2211 to 0.5.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/465">#465</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>7b0f2490b8bbf8914182da1667e5153d2c9e0e00: chore(deps): bump golang.org/x/crypto from 0.0.0-20211117183948-ae814b36b871 to 0.6.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/464">#464</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>c386074f970f1ed4cabfb27bef838316b2398783: chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.4.0 to 0.5.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/459">#459</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>ad9ad1068d9b85aec2da6afc7d2ae66266d06d45: chore(deps): bump golang.org/x/term from 0.5.0 to 0.6.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/468">#468</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>ba794d1d5f4a1e0be5d1a7fc0c71502032963b4a: chore(deps): bump golang.org/x/crypto from 0.6.0 to 0.7.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/469">#469</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>d271873280caf7a2dbc04b81626519dcd2294068: chore(deps): bump securesystemslib from 0.26.0 to 0.27.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/471">#471</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>493ab6cae58942542e27093b1ec23095fe8e51bd: chore(deps): bump actions/setup-go from 3.5.0 to 4.0.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/472">#472</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>7f231b3d8147d909d09ba4825e6c8a3924b67828: chore(deps): bump amannn/action-semantic-pull-request from 5.1.0 to 5.2.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/473">#473</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>7cddf5836cb16160ef10b5bcb1be925eef5924e0: docs: Update install instructions in README (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/474">#474</a>) (<a href="https://github.com/haydentherapper"><code>@​haydentherapper</code></a>)</li>
<li>30b7aaeaef868981b90ce4c2b5313525093ec837: chore(deps): bump golang.org/x/term from 0.6.0 to 0.7.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/477">#477</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>ab35782b35129e2247e05c337b62c937dbabcc81: chore(deps): bump golang.org/x/crypto from 0.7.0 to 0.8.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/478">#478</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>c7d649bb18924696cd46e1d16b195335bd12f7a2: ci(build): Add arm64 to build (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/463">#463</a>) (<a href="https://github.com/udf2457"><code>@​udf2457</code></a>)</li>
<li>798677257321d3e9c527c1d56edfe2e14e479015: chore(deps): bump arnested/go-version-action from 1.1.7 to 1.1.8 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/480">#480</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>7a57438b63ef093a93093ebb88ce97015052caed: chore(deps): bump securesystemslib from 0.27.0 to 0.28.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/481">#481</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>c79b5e65c76a80581a023e3d88818b1012cd8325: chore(deps): bump actions/setup-python from 4.5.0 to 4.6.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/482">#482</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>8edc996a21302a73956dba64276d560392fa7979: chore(deps): bump shogo82148/actions-goveralls from 1.6.0 to 1.7.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/483">#483</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>e077a6808a51328e74b887e0e7de9aa34754fa79: chore(deps): bump requests from 2.28.2 to 2.29.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/484">#484</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>39f588c46c5866a066b309bf936db4b1e59d682c: chore(deps): bump golang.org/x/term from 0.7.0 to 0.8.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/487">#487</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>dfbd21a34f0bc34f21dc1949400bc45e1eb59a5d: chore(deps): bump requests from 2.29.0 to 2.30.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/488">#488</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>56698a36ec66febfe2cdf44957bfa1d024bcc76e: chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.5.0 to 0.6.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/486">#486</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>b4feccd966f4e275e48a6e0a39bcee801a661cb1: chore(deps): bump golang.org/x/crypto from 0.8.0 to 0.9.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/489">#489</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>ed58d45ef6cebb3eef95153ba794e85c95d08b67: chore(deps): bump actions/setup-go from 4.0.0 to 4.0.1 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/491">#491</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>e9da9a9a0cf1b74de045c248d491d2a0781f7570: chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/493">#493</a>) (<a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>d1450a59a5a6ad0f9ddc72b2dc6fc4d83b0140ac: chore: Bump spec version (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/495">#495</a>) (<a href="https://github.com/znewman01"><code>@​znewman01</code></a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/ca0c316673ca2482fa188b36e44c3b49d4a8fd10"><code>ca0c316</code></a> fix: fail to load deprecated ecdsa verifier (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/541">#541</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/ad706edfd9d11977f71277ceddcaebd79b606dff"><code>ad706ed</code></a> chore(deps): bump golang.org/x/crypto from 0.11.0 to 0.12.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/539">#539</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/4e4f7f3c2772bf637d0ff9c524ddda5e6dd8dc79"><code>4e4f7f3</code></a> chore(deps): bump actions/setup-python from 4.6.1 to 4.7.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/519">#519</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/7b85661d635d4be0a4add2336549141d45715c52"><code>7b85661</code></a> chore: add govulncheck and bump Go to 1.20 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/523">#523</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/8efd6cdb12ba7c28d10ede9fd00ba708ef71fa68"><code>8efd6cd</code></a> test: add python-tuf v3.0.0 support (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/515">#515</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/9774d7980aaec85ebcc7eaf8bd6d6e7c6747d2a3"><code>9774d79</code></a> feat!: add deprecating message for the encrypted package (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/521">#521</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/e2f53d95b2c961af2dbb48f3af7502fc308e48aa"><code>e2f53d9</code></a> chore(deps): bump github.com/secure-systems-lab/go-securesystemslib from 0.6....</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/030ef07acf6d98da518945f813d0f6648141b187"><code>030ef07</code></a> chore(deps): bump arnested/go-version-action from 1.1.11 to 1.1.12 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/520">#520</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/5ed62397581b953bacae5bf46b8c7dac4d85df1d"><code>5ed6239</code></a> chore(deps): bump golang.org/x/crypto from 0.10.0 to 0.11.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/514">#514</a>)</li>
<li><a href="https://github.com/theupdateframework/go-tuf/commit/aa1a857496c35cd10492427c660ecd8834b5037c"><code>aa1a857</code></a> chore(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 (<a href="https://redirect.github.com/theupdateframework/go-tuf/issues/513">#513</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/theupdateframework/go-tuf/compare/v0.5.2...v0.6.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/theupdateframework/go-tuf&package-manager=go_modules&previous-version=0.5.2&new-version=0.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/sigstore/cosign/pull/3183?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
> Merging [#3183](https://app.codecov.io/gh/sigstore/cosign/pull/3183?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (43d3dc4) into [main](https://app.codecov.io/gh/sigstore/cosign/commit/1c3208b3a9f2b746517e73bff940921055dbe549?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (1c3208b) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main    #3183   +/-   ##
=======================================
  Coverage   30.54%   30.54%           
=======================================
  Files         155      155           
  Lines        9809     9809           
=======================================
  Hits         2996     2996           
  Misses       6365     6365           
  Partials      448      448           
```




haydentherapper: I'm OK with https://github.com/sigstore/cosign/pull/3128#issuecomment-1648224642 - @znewman01, you OK with that too? Otherwise we can use `EncryptWithCustomKDFParameters`
haydentherapper: @dependabot rebase
dependabot[bot]: Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request `@dependabot recreate`.

haydentherapper: Tests just seem unhappy today, let's retry on monday

Patch:
diff --git a/PKCS11.md b/PKCS11.md
index 18ba9c55..091ec3e3 100644
--- a/PKCS11.md
+++ b/PKCS11.md
@@ -1,1 +1,1 @@
-> Note of deprecation: This document has been migrated into [`sigstore/docs`](https://github.com/sigstore/docs/blob/main/content/en/cosign/pkcs11.md) as part of [documentation migration](https://github.com/sigstore/cosign/issues/822) and PR: https://github.com/sigstore/docs/pull/129. To view the live docs page, go to: https://docs.sigstore.dev/cosign/pkcs11
+> Note of deprecation: This document has been migrated into [`sigstore/docs`](https://github.com/sigstore/docs/blob/main/content/en/signing/pkcs11.md) as part of [documentation migration](https://github.com/sigstore/cosign/issues/822) and PR: https://github.com/sigstore/docs/pull/129. To view the live docs page, go to: https://docs.sigstore.dev/signing/pkcs11/
diff --git a/README.md b/README.md
index 620af2a3..c1f0ea0b 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ Click [here](https://join.slack.com/t/sigstore/shared_invite/zt-mhs55zh0-XmY3bcf
 
 ## Installation
 
-For Homebrew, Arch, Nix, GitHub Action, and Kubernetes installs see the [installation docs](https://docs.sigstore.dev/cosign/installation).
+For Homebrew, Arch, Nix, GitHub Action, and Kubernetes installs see the [installation docs](https://docs.sigstore.dev/system_config/installation/).
 
 For Linux and macOS binaries see the [GitHub release assets](https://github.com/sigstore/cosign/releases/latest).
 
diff --git a/go.mod b/go.mod
index 55cadc15..4cc3b433 100644
--- a/go.mod
+++ b/go.mod
@@ -43,7 +43,6 @@ require (
 	github.com/spf13/viper v1.16.0
 	github.com/spiffe/go-spiffe/v2 v2.1.6
 	github.com/stretchr/testify v1.8.4
-	github.com/theupdateframework/go-tuf v0.5.2
 	github.com/transparency-dev/merkle v0.0.2
 	github.com/withfig/autocomplete-tools/integrations/cobra v1.2.1
 	github.com/xanzy/go-gitlab v0.90.0
@@ -243,6 +242,7 @@ require (
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
+	github.com/theupdateframework/go-tuf v0.6.1 // indirect
 	github.com/tinylib/msgp v1.1.6 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	github.com/tjfoc/gmsm v1.3.2 // indirect
diff --git a/go.sum b/go.sum
index f8159b83..465a8f26 100644
--- a/go.sum
+++ b/go.sum
@@ -953,8 +953,8 @@ github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BG
 github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
-github.com/theupdateframework/go-tuf v0.5.2 h1:habfDzTmpbzBLIFGWa2ZpVhYvFBoK0C1onC3a4zuPRA=
-github.com/theupdateframework/go-tuf v0.5.2/go.mod h1:SyMV5kg5n4uEclsyxXJZI2UxPFJNDc4Y+r7wv+MlvTA=
+github.com/theupdateframework/go-tuf v0.6.1 h1:6J89fGjQf7s0mLmTG7p7pO/MbKOg+bIXhaLyQdmbKuE=
+github.com/theupdateframework/go-tuf v0.6.1/go.mod h1:LAFusuQsFNBnEyYoTuA5zZrF7iaQ4TEgBXm8lb6Vj18=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tinylib/msgp v1.1.6 h1:i+SbKraHhnrf9M5MYmvQhFnbLhAXSDWF8WWsuyRdocw=
diff --git a/pkg/cosign/keys.go b/pkg/cosign/keys.go
index 3ab43cae..9adc2252 100644
--- a/pkg/cosign/keys.go
+++ b/pkg/cosign/keys.go
@@ -30,8 +30,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/theupdateframework/go-tuf/encrypted"
-
+	"github.com/secure-systems-lab/go-securesystemslib/encrypted"
 	"github.com/sigstore/cosign/v2/pkg/oci/static"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"


Test patch:
diff --git a/cmd/cosign/cli/attest/attest_blob_test.go b/cmd/cosign/cli/attest/attest_blob_test.go
index 65d6396e..1f40a9e5 100644
--- a/cmd/cosign/cli/attest/attest_blob_test.go
+++ b/cmd/cosign/cli/attest/attest_blob_test.go
@@ -31,13 +31,13 @@ import (
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/pkg/errors"
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
+	"github.com/secure-systems-lab/go-securesystemslib/encrypted"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	"github.com/theupdateframework/go-tuf/encrypted"
 )
 
 // TestAttestBlobCmdLocalKeyAndSk verifies the AttestBlobCmd returns an error
diff --git a/cmd/cosign/cli/sign/sign_test.go b/cmd/cosign/cli/sign/sign_test.go
index afb43e3e..6959ba3f 100644
--- a/cmd/cosign/cli/sign/sign_test.go
+++ b/cmd/cosign/cli/sign/sign_test.go
@@ -28,13 +28,13 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
+	"github.com/secure-systems-lab/go-securesystemslib/encrypted"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/sigstore/cosign/v2/internal/ui"
 	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/cosign/v2/test"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
-	"github.com/theupdateframework/go-tuf/encrypted"
 )
 
 func pass(s string) cosign.PassFunc {