Index hosted attestations: Add optional timestamps

[jku]

Sigstore public good instance is transitioning to Rekor v2 transparency log: v2 no longer includes integrated time in the log entries so external timestamps are needed.

The companion PR to this is pypi/pypi-attestations#143. There is an overall tracking issue in pypi/pypi-attestations#147

This is definitely still draft:

• I've not gone through the document to ensure there aren't other changes that are required
• I'm not sure if the attestation format needs a version change for this or not

[Copilot]

Pull Request Overview

This PR adds optional RFC3161 timestamp support to the attestation format, enabling compatibility with Sigstore's Rekor v2 transparency log which no longer includes integrated timestamps in log entries.

Key Changes

• Added optional timestamps field to verification material for storing external RFC3161 timestamps
• Updated verification requirements to clarify that inclusion time can come from either integrated timestamps or external RFC3161 timestamps

Comments suppressed due to low confidence (1)

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[jku]

I'd like to get some advice on how to handle the fact that I'm adding a new field to the attestation:

• Are the only potential incompatibilities within pypi-attestations project or should I look elsewhere too?
• The attestation has a version (1), should that be bumped? the pypi-attestations code does not need it but at least I could then mention in a comment that version 1 did not have the timestamps field...

[woodruffw]

• Are the only potential incompatibilities within pypi-attestations project or should I look elsewhere too?

That's the main place, yeah 🙂

• The attestation has a version (1), should that be bumped? the pypi-attestations code does not need it but at least I could then mention in a comment that version 1 did not have the timestamps field...

Yeah, I think we probably should bump it -- it's technically a semantic change to verification.