v0.0.23

Added

• The CLI has a new subcommand convert, which takes a Sigstore bundle
  and converts it to a PEP 740 attestation.

Changed

• The Attestation.verify(...) API has been changed to accept an offline
  parameter that, when True, disables TUF refreshes.
• The CLI verify commands now also accept an --offline flag that disables
  TUF refreshes. Additionally, when used with the verify pypi subcommand, the
  --offline flag enforces that the distribution and provenance file arguments
  must be local file paths.

Fixed

• Fixed a bug where GitHubPublisher policy verification would fail
  if the Source Repository Ref or Source Repository Digest claim
  was missing from the attestation's certificate. We require at least
  one of the two claims, but not necessarily both
  (#109)