Unable to update embedded TUF root - network access required

[Copilot]

Issue

This PR was created to address issue regarding the outdated embedded TUF root, which requires running make update-embedded-root to download and embed the latest TUF metadata from the Sigstore TUF repository.

Blocker

The task cannot be completed in the current sandboxed environment due to network restrictions. The domain tuf-repo-cdn.sigstore.dev is blocked, preventing the download of updated TUF metadata files.

What needs to happen

To complete this task, one of the following is required:

1. Grant network access to tuf-repo-cdn.sigstore.dev in the sandboxed environment, allowing the automated execution of make update-embedded-root
2. Manually run make update-embedded-root in an environment with network access and provide the updated files for commit

Expected changes

Once network access is available, the following files will be updated:

• sigstore/_store/https%3A%2F%2Ftuf-repo-cdn.sigstore.dev/root.json
• sigstore/_store/https%3A%2F%2Ftuf-repo-cdn.sigstore.dev/trusted_root.json
• sigstore/_store/https%3A%2F%2Ftuf-repo-cdn.sigstore.dev/signing_config.v0.2.json

This update will improve cold-cache performance for sigstore-python users.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• tuf-repo-cdn.sigstore.dev
  • Triggering command: python -m sigstore plumbing update-trust-root (dns block)
  • Triggering command: curl -I REDACTED (dns block)
  • Triggering command: ping -c 1 tuf-repo-cdn.sigstore.dev (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Embedded TUF root is not up-to-date</issue_title>
<issue_description>
The Sigstore TUF repository contents have changed: the data embedded
in sigstore-python sources can be updated. This is not urgent but will improve cold-cache performance.

Run make update-embedded-root to update the embedded data.

This issue was filed by Check embedded root workflow run.
</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #1581

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.