Upgrade tuf dependency to 4.0 (#135)

although the tuf api changes in 4.0 don't appear to affect us on the repo side,
there is a breaking change in the client due to our use of the private tuf.ngclient.Updater_trusted_set

see theupdateframework/python-tuf@cb9aa4a

* upgrade python-tuf dependency to 4.0+

* adapt tufup.client.Client to changes in tuf.ngclient.Updater._trusted_set

pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
     "packaging>=21.3",
     "securesystemslib[crypto,pynacl]>=0.26.0",
     "setuptools>=65.5.1",
-    "tuf==3.1.*",
+    "tuf==4.0.*",
     # constraints on sub-dependencies
     "certifi>=2022.12.7",
     "cryptography>=38.0.3",

src/tufup/client.py

@@ -70,7 +70,7 @@ def trusted_target_metas(self) -> list:
         if self._trusted_set.targets:
             _trusted_target_metas = [
                 TargetMeta(target_path=key, custom=target.custom)
-                for key, target in self._trusted_set.targets.signed.targets.items()
+                for key, target in self._trusted_set.targets.targets.items()
             ]
             logger.debug(f'{len(_trusted_target_metas)} TargetMeta objects created')
         else: