Require Sigstore >= 3.6.2, < 4

Author: hugovk

run_release.py

@@ -368,13 +368,16 @@ def check_sigstore_client(db: ReleaseShelf) -> None:
 
 def check_sigstore_version(version: str) -> None:
     version_match = re.match("^sigstore ([0-9.]+)", version)
-    if not version_match or tuple(
-        int(part) for part in version_match.group(1).split(".")
-    ) < (3, 5):
-        raise ReleaseException(
-            f"Sigstore version not detected or not valid. "
-            f"Expecting 3.5.x or later: {version}"
-        )
+    if version_match:
+        version_tuple = tuple(int(part) for part in version_match.group(1).split("."))
+        if (3, 6, 2) <= version_tuple < (4, 0):
+            # good version
+            return
+
+    raise ReleaseException(
+        f"Sigstore version not detected or not valid. "
+        f"Expecting >= 3.6.2 and < 4.0.0, got: {version}"
+    )
 
 
 def check_buildbots(db: ReleaseShelf) -> None:

tests/test_run_release.py

@@ -13,7 +13,7 @@
 
 @pytest.mark.parametrize(
     "version",
-    ["sigstore 3.5.0", "sigstore 4.0.0"],
+    ["sigstore 3.6.2", "sigstore 3.6.6"],
 )
 def test_check_sigstore_version_success(version) -> None:
     # Verify runs with no exceptions
@@ -22,7 +22,7 @@ def test_check_sigstore_version_success(version) -> None:
 
 @pytest.mark.parametrize(
     "version",
-    ["sigstore 2.0.0", "sigstore 3.4.0", ""],
+    ["sigstore 3.4.0", "sigstore 3.6.0", "sigstore 4.0.0", ""],
 )
 def test_check_sigstore_version_exception(version) -> None:
     with pytest.raises(