build(deps-dev): bump in-toto from 1.4.0 to 2.3.0

[dependabot]

Bumps in-toto from 1.4.0 to 2.3.0.

Release notes

Sourced from in-toto's releases.

v2.3.0

See CHANGELOG.md for details.

v2.2.0

See CHANGELOG.md for details.

v2.1.1

Changed

• Default type for CLI arg --run-timeout to avoid type mismatch (#626)
• Dependency update (#627)

v2.1.0

Added

• CLI argument to control command execution timeout (#605)
• ITE-4 resolver for directories ("dirHash", #590)

Changed

• Lint configuration (#602)
• Output stream cleanup to address flaky tests on Windows (#597)
• Layout expiry condition (#616)
• Dependency updates (#604, #607, #608, #609, #617, #618, #619, #620, #622, #623)

Removed

• AppVeyor test configuration (#598)

v2.0.0

This release includes breaking changes such as the removal of the user_settings module and changes to exceptions raised during artifact recording. Additionally, it incorporates changes for issues captured in security advisories GHSA-p86f-xmg6-9q4x, GHSA-jjgp-whrp-gq8m, and GHSA-wc64-c5rv-32pf, the last of which has been assigned CVE-2023-32076.

Added

• Generic interface for ITE-4 resolvers (#584)
• ITE-4 resolver for OSTree repositories (#585)
• Warning when --bits is used with non RSA keys in in-toto-keygen (#588)
• Support for GitHub's security reporting feature (#567)
• Tool to check local artifacts against in-toto link metadata (#589, GHSA-p86f-xmg6-9q4x)
• Testing in CI for Python 3.11 (#594)

Changed

• Recording of file hashes to use ITE-4 file resolver (#584)
• Exceptions returned to Python defaults when recording file artifacts (#592)
• Documentation about in-toto governance to reflect project changes (#591)
• Code style to use black + isort, includes update to codebase to conform (#593)
• Verification documentation to reflect how PGP trust model is used (GHSA-jjgp-whrp-gq8m)

Removed

• Support for user_settings module that enabled configuring in-toto via RC files and environment variables (GHSA-wc64-c5rv-32pf)

Changelog

Sourced from in-toto's changelog.

v2.3.0

Added

• in-toto-verify CLI: --inspection-timeout arg (#695)

Changed

• Improve Dependabot config (#701)
• Constrain securesystemslib dependency to <0.32.0 in preparation for future securesystemslib API changes (#726)

Removed

• Obsolete six dependency in debian/control (#687)

v2.2.0

NOTE: This release, fully integrates the new securesystemslib Signer API . Most notably, runlib API methods receive a new optional argument to sign the resulting metadata with a securesystemslib Signer (see securesystemslib for available implementations). In addition, the in-toto CLI provides new arguments to read consistent standard key file formats for signing (PEM/PKCS8) and signature verification (PEM/subjectPublicKeyInfo).

Related legacy key arguments are deprecated and will be removed in the next major release. securesystemslib provides a script to migrate key files .

Added

• in-toto-run/record CLI: --signing-key arg (#649, #651)
• in-toto-verify CLI: --verification-keys arg (#652)
• runlib API: signer arg (#612)
• Release automation with PyPI Trusted Publishers (#674)

Changed

• Update key file formats in internal in-toto-sign CLI (#654)
• Refactor model methods to use modern Signer API (#653, #660)
• Refactor model and input validation (#665)
• Misc CI improvements (#635, #636, #637, #650)
• Misc docs improvements (#641, #664)
• Misc test improvements (#655, #656, #668)

Deprecated

• in-toto-run/record CLI: -k, --key arg (#649, #651)
• in-toto-verify CLI: -k, --layout-keys arg (#674)
• runlib API: signing_key arg (#612)
• model API: Metablock.sign() method (#659)

Removed

• Python 3.7 support (#634)
• in-toto-keygen CLI (#657)

... (truncated)

Commits

• d6e78aa Merge pull request #732 from lukpueh/ci-continue-on-error-in-sslib-main
• 15b15e6 Run CD build despite "with-sslib-main" test error
• 8ce403f Merge pull request #729 from lukpueh/release-2.3.0
• af9f62d Release v2.3.0
• af88b80 Merge pull request #727 from in-toto/revert-724-adopt-new-signer-property
• deaf122 Revert "Adopt mandatory Signer.public_key property"
• 07cd143 Merge pull request #724 from lukpueh/adopt-new-signer-property
• b9b656a Merge pull request #726 from lukpueh/pin-sslib-0.31
• 54644bf Pin securesystemslib to current minor version
• b8ff284 Merge pull request #723 from in-toto/dependabot/github_actions/action-depende...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)