Upgrade to sigstore 4.0.0

add_to_pydotorg.py

@@ -365,7 +365,7 @@ def has_sigstore_signature(filename: str) -> bool:
         )
 
     # Ensure that Sigstore CLI installed on the download server is
-    # at least v3.0.0 or later to ensure valid Sigstore bundles are generated.
+    # at least v4.0.0 or later to ensure valid Sigstore bundles are generated.
     try:
         sigstore_version_stdout = subprocess.check_output(
             ["python3", "-m", "sigstore", "--version"]
@@ -380,9 +380,9 @@ def has_sigstore_signature(filename: str) -> bool:
             )
         sigstore_version = sigstore_version_match.group(1)
         sigstore_major_version = int(sigstore_version.partition(".")[0])
-        if sigstore_major_version < 3:
+        if sigstore_major_version < 4:
             error(
-                f"Sigstore v3 or later must be installed "
+                f"Sigstore v4 or later must be installed "
                 f"(currently {sigstore_version}), "
                 f"run: python -m pip install -r requirements.txt"
             )

mypy-requirements.txt

@@ -5,6 +5,6 @@ pyfakefs
 pytest
 pytest-mock
 python-gnupg  # untyped :(
-sigstore==3.6.5
+sigstore==4.0.0
 types-paramiko
 types-requests

requirements.in

@@ -5,4 +5,4 @@ alive_progress>=3.3.0
 python-gnupg
 aiohttp
 blurb>=1.2.1
-sigstore>=3
+sigstore>=4