Prep 0.9.0 (#364)

* sigstore: 0.9.0

Signed-off-by: William Woodruff <[email protected]>

* CHANGELOG: record changes

Signed-off-by: William Woodruff <[email protected]>

Signed-off-by: William Woodruff <[email protected]>

CHANGELOG.md

@@ -4,9 +4,35 @@ All notable changes to `sigstore-python` will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-All versions prior to 0.8.4 are untracked.
+All versions prior to 0.9.0 are untracked.
 
 ## [Unreleased]
 
+## [0.9.0]
+
+### Added
+
+* `sigstore verify` now supports `--certificate-chain` and `--rekor-url`
+  during verification. Ordinary uses (i.e. the default or `--staging`)
+  are not affected ([#323](https://github.com/sigstore/sigstore-python/pull/323))
+
+### Changed
+
+* `sigstore sign` and `sigstore verify` now stream their input, rather than
+  consuming it into a single buffer
+  ([#329](https://github.com/sigstore/sigstore-python/pull/329))
+
+* A series of Python 3.11 deprecation warnings were eliminated
+  ([#341](https://github.com/sigstore/sigstore-python/pull/341))
+
+* The "splash" page presented to users during the OAuth flow has been updated
+  to reflect the user-friendly page added to `cosign`
+  ([#356](https://github.com/sigstore/sigstore-python/pull/356))
+
+* `sigstore` now uses TUF to retrieve its trust material for Fulcio and Rekor,
+  replacing the material that was previously baked into `sigstore._store`
+  ([#351](https://github.com/sigstore/sigstore-python/pull/351))
+
 <!--Release URLs -->
-[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v0.8.3...HEAD
+[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/sigstore/sigstore-python/compare/v0.8.3...v0.9.0

sigstore/__init__.py

@@ -16,4 +16,4 @@
 The `sigstore` APIs.
 """
 
-__version__ = "0.8.3"
+__version__ = "0.9.0"