Fix Windows embedded file path bug

[malancas]

Summary

This fixes a Windows compatibility issue related to embedded file paths and a bug downloading target metadata in the go-tuf library.

Fixes #102

Release Note

Documentation

[haydentherapper]

Build action is stuck

[malancas]

Build action is stuck

I'll take a look

[kommendorkapten]

On the stuck build job @malancas wrote this to me:

I see the build workflow is hanging on the PR, I'm guessing it has to do with the new matrix jobs and the build job not matching the required checks list anymore

And the branch protection rule requires a job named build to run https://github.com/sigstore/community/blob/main/github-sync/github-data/sigstore/repositories.yaml#L1860
And we can see that in the list above.

Can that be the issue, as it does say: 1 expected check, but there is no link to any details. The build jobs from the build with a matrix are reported as "Build and test/build ()".

How about renaming the build job to build-and-test then create a new job build, that does nothing but requires all the build from build-and-test?

[malancas]

The required cosign status checks account for platform related matrix jobs: https://github.com/sigstore/community/blob/main/github-sync/github-data/sigstore/repositories.yaml#L228-L230. We could update the sigstore-go required checks entry to match this.

[haydentherapper]

Ah good catch, yea we'll need to update the checks in the community repo.

[malancas]

I'll open a PR for that now

[haydentherapper]

@kommendorkapten not a blocker, but do you know when go-tuf maintainers will be cutting a release with the v2 implementation?

[kommendorkapten]

@haydentherapper there is still one open bug for Windows in go-tuf that I intend to fix today. When all test cases are working for all platforms, and we have a clear understanding of the current open issues, I think it's time we create a first release. I would guess one-two weeks from now?

[malancas]

When someone has time to review: sigstore/community#408

[haydentherapper]

Should be good now. Once merged we'll just need to rebase other PRs