Prepare v0.20.0

[lukpueh]

NOTE: This will be the final release of python-tuf that includes the legacy implementation code. Please see the 1.0.0 announcement page for more details about the next release and the deprecation of the legacy implementation, including migration instructions.

Added

• metadata API: misc input validation (Metadata API: validate root role names #1630, Delegations: paths & path_hash_prefixes validation #1688, Metadata API: make Root roles a Mapping #1668, Create constants for top-level rolenames #1672, Prevents delegate role name as top-level role name #1690)
• doc: repository library design document and ADR (ADR: Add New repository library design #1693)
• doc: 1.0.0 announcement (doc: announce 1.0.0 stable release #1706)
• doc: misc docstrings in metadata API (Add missing method args docs in metadata API #1620)
• doc: repository and client examples (TUF Python Client Example/Tutorial #1675, Docs: Add repository tutorial based on metadata API #1685, doc: basic hash bin delegation repo example + test #1700)
• test: ngclient key rotation (tests: Add ngclient root key rotation tests #1635, Clarify key rotations test cases by using keywords #1649, Tests: add tests for non-root key rotations #1691)
• test: ngclient top-level role update (ngclient: top-level-roles update tests #1636)
• test: ngclient non-consistent snapshot (RepositorySimulator: add non-consistent snapshot support #1666, Implemented fetch_tracker to RepositorySimulator #1705)
• test: more lint/type checks and auto-formatting (New implementation tests: apply black and isort automatic linting fixes #1658, New implementation tests: address pylint warnings #1664, pylintc for new code: disable format checker #1659, Tests: address new pylint warnings #1674,
  Advertize type annotations with py.typed #1677, Tests on the new implementation: address mypy warnings #1687, Move linters configurations in pyproject.toml #1699, Start linting the examples folder #1701, Lint additional four files in the tests folder #1708, Start linting the test #1710, test: add missing return type hint in test method #1720)
• build: Python 3.10 support (Add python3.10 and fix test failures on python3.10 #1628)

Changed

• ngclient: misc API changes (Ngclient api polish #1604)
• ngclient: avoid re-loading verified targets metadata (ngclient: Avoid loading targets metadata twice #1593)
• ngclient: implicitly call refresh() (ngclient: Implicitly call refresh() #1654)
• ngclient: return loaded metadata (Update ngclient to return loaded metadata #1680)
• ngclient: skip visited nodes on delegation tree traversal (Update ngclient to skip visited nodes on delegation tree traversal #1683)
• ngclient: remove URL normalisation (Remove URL normalisation #1686)
• build: modernise packaging configuration (Modernise packaging configuration #1626)
• build: bump dependencies (build(deps): bump certifi from 2021.5.30 to 2021.10.8 #1609, build(deps): bump charset-normalizer from 2.0.6 to 2.0.7 #1611, build(deps): bump idna from 3.2 to 3.3 #1616, build(deps): bump cffi from 1.14.6 to 1.15.0 #1621)
• build: limit GitHub Action token visibility and permissions (GH actions: limit GitHub token visibility #1652, github: explicitly set workflow permissions #1663)
• test: misc test changes (tests: Refactor client bootstrap #1715, Tests: self.assertRaises -> with self.assertRaises #1670, Tests: test_api split test_sign_verify() #1671, Test metadata files: bump expiration date and resign #1631, Fix inconsistent behaviour of compute_metafile_hashes_length #1695)

Removed

• doc: obsolete roadmap (docs: Remove ROADMAP #1698)

[coveralls]

Pull Request Test Coverage Report for Build 1572875550

• 1 of 1(100.0%) changed or added relevant line in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 97.577%

---

Totals
Change from base Build 1563115608:	0.0%
Covered Lines:	4092
Relevant Lines:	4177

---

💛 - Coveralls

[jku]

• #1722 looks like a blocker
• announcement link is wrong (see below)

otherwise LGTM

[jku]

Not sure if that was a mistake but the 1.0.0 announcement ended up in root dir so this link does not work. Do we move the announcement?

[lukpueh]

🤦 Thanks for catching this!

[jku]

I've got an updated branch in https://github.com/jku/python-tuf/tree/release-0.20.0 but

• I'd like to stop saying ngclient is not ready for prod: I've updated README in the branch
• but if I do that, then I don't want to break ngclient API even in a minor way after that unless I really have to...
• which means we should maybe handle the argument name change before 0.20: ngclient: Rename constructor arg #1731?

[lukpueh]

I've got an updated branch in https://github.com/jku/python-tuf/tree/release-0.20.0 but

• I'd like to stop saying ngclient is not ready for prod: I've updated README in the branch

Cool, thanks! Do you want to merge the README change with this PR, or create a separate one? Also, while changing the README, would you mind adding the cncf python-tuf slack channel to the contact section? I'm pointing migration help seekers to that section in the 1.0.0-ANNOUNCEMENT doc, and I think the slack channel would be a good way to reach out to us.

• but if I do that, then I don't want to break ngclient API even in a minor way after that unless I really have to...

I am not so concerned about minor breaking changes prior to 1.0.0. But yeah, ...

• which means we should maybe handle the argument name change before 0.20: ngclient: Rename constructor arg #1731?

... the rename can easily land with 0.20 (just merged).

[jku]

I can make a new PR, thanks

[jku]

I'll close this as superseded by #1732 (but feel free to redo if needed @lukpueh i'm just hopefully helping out)