Plans for 2.0 release

[di]

We've had two v2.0.0 release candidates out for a while now (v2.0.0rc2 was released Jul 21), it's probably time to plan on making our v2.0.0 release.

I propose the following timeline:

• now: determine if there are any issues remaining that we need to resolve before a 2.0 release, add them to the 2.0 milestone:
  • I think sign: Make SigningResult._to_bundle() public #765 would be nice to include but probably shouldn't be a blocker
  • Seems like Verification: Switch to new-style claim extensions #654 is planned for 2.0, but might not be a blocker
  • Fulcio: Switch to new-style claim extensions #425 is in the 2.0 milestone, but Fulcio: Switch to new-style claim extensions #425 (comment) says it shouldn't block 2.0, so maybe it should be moved.
• by EOW (Sept 15th): make a final v2.0.0.0rc3 release candidate
• by EOM (Sept 29th): make a v2.0.0 release

(cc @jku @woodruffw @haydentherapper for thoughts)

[woodruffw]

Thanks @di!

I agree fully with this timeline -- #654 and #425 are basically dupes, and I think we can remove it from the 2.0 milestone per the comment you linked (it isn't currently broken, won't break until Fulcio 2.0, and would be a significant blocker here).

[haydentherapper]

#425 would be nice to have as part of 2.0, so that we can start verifying CI provenance claims with sigstore-python. However it'd be a non-breaking change to add it later (as long as you continue to support the current set of claims).

[woodruffw]

would be nice to have as part of 2.0, so that we can start verifying CI provenance claims with sigstore-python. However it'd be a non-breaking change to add it later (as long as you continue to support the current set of claims).

Agreed on both counts -- I think it'd be nice to have, but #425 (comment) has some medium term blockers for why (IMO) we should punt on it until 2.1 or similar (and keep the current set of claims around for compat as well).

[woodruffw]

2.0 has landed, so closing!