[bug] Installation failing with slsa-verifier 2.3.0

[anatoly-scherbakov]

Describe the bug
Using commands as per README.md leads to the following error:

$ ./slsa-verifier verify-artifact todos --provenance-path=todos.intoto.jsonl --source-uri=github.com/ianlewis/todos --source-tag=v0.8.0
Verifying artifact todos: FAILED: error retrieving Rekor public keys: updating local metadata and targets: error updating to TUF remote mirror: invalid key
remote status:{
        "mirror": "https://tuf-repo-cdn.sigstore.dev",
        "metadata": {
                "timestamp.json": {
                        "version": 224,
                        "len": 449,
                        "expiration": "01 Oct 24 13:26 UTC",
                        "error": ""
                }
        }
}

FAILED: SLSA verification failed: error retrieving Rekor public keys: updating local metadata and targets: error updating to TUF remote mirror: invalid key
remote status:{
        "mirror": "https://tuf-repo-cdn.sigstore.dev",
        "metadata": {
                "timestamp.json": {
                        "version": 224,
                        "len": 449,
                        "expiration": "01 Oct 24 13:26 UTC",
                        "error": ""
                }
        }
}

To Reproduce
Steps to reproduce the behavior:

Run the installation commands from README.md on Ubuntu AMD64.

Expected behavior
slsa-verifier should install the app.

Screenshots
Output provided above.

Additional context
Upgrading slsa-verifier to 2.6.0, and changing the checksum accordingly, fixes the issue.

[ianlewis]

Unfortunately, sigstore updates their TUF root certificates every year and this is reflected in older versions of slsa-verifier not being able to verify provenance.

It should work with slsa-verifier. 2.6.0 and I'll update the documentation to use this version.