Sigstore Signer tests failing

[lukpueh]

E.g. in unrelated #1051, #1052, cc @jku

sigstore: install_deps> pip install -r /home/runner/work/securesystemslib/securesystemslib/requirements-pinned.txt -r /home/runner/work/securesystemslib/securesystemslib/requirements-sigstore.txt
sigstore: freeze> python -m pip freeze --all
sigstore: annotated-types==0.7.0,asn1crypto==1.5.1,certifi==2025.11.12,cffi==2.0.0,charset-normalizer==3.4.4,cryptography==46.0.3,dnspython==2.8.0,email-validator==2.3.0,id==1.5.0,idna==3.11,markdown-it-py==4.0.0,mdurl==0.1.2,pip==25.3,platformdirs==4.5.0,pyasn1==0.6.1,pycparser==2.23,pydantic==2.12.5,pydantic_core==2.41.5,Pygments==2.19.2,PyJWT==2.10.1,PyKCS11==1.5.18,pyOpenSSL==25.3.0,PySPX==0.5.0,requests==2.32.5,rfc3161-client==1.0.5,rfc8785==0.1.4,rich==14.2.0,securesystemslib==1.3.1,sigstore==4.1.0,sigstore-models==0.0.5,sigstore-rekor-types==0.0.18,tuf==6.0.0,typing-inspection==0.4.2,typing_extensions==4.15.0,urllib3==2.5.0
sigstore: commands[0]> python -m tests.check_sigstore_signer
setUpClass (__main__.TestSigstoreSigner) ... ERROR

======================================================================
ERROR: setUpClass (__main__.TestSigstoreSigner)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/runner/work/securesystemslib/securesystemslib/tests/check_sigstore_signer.py", line 97, in setUpClass
    cls.token = identity_token()
                ~~~~~~~~~~~~~~^^
  File "/home/runner/work/securesystemslib/securesystemslib/tests/check_sigstore_signer.py", line 89, in identity_token
    raise TimeoutError(f"Failed to find a valid token in {max_retry_time}")
TimeoutError: Failed to find a valid token in 0:01:00

----------------------------------------------------------------------
Ran 0 tests in 61.682s

FAILED (errors=1)
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
Current token expires too early, retrying in 5 seconds.
sigstore: exit 5 (62.05 seconds) /home/runner/work/securesystemslib/securesystemslib> python -m tests.check_sigstore_signer pid=2239
  sigstore: FAIL code 5 (69.61=setup[7.55]+cmd[62.05] seconds)
  evaluation failed :( (69.66 seconds)
Error: Process completed with exit code 5.

[jku]

I wonder if I should just increase the retry delay to like 30 secs if CI env variable is set (and keep retrying for longer) -- these seems to be just the inherent unreliability of the test token (it's produced by a GitHub workflow and there's no promise that the workflow is run often enough) since retrying manually works

[jku]

It should be doing that already:

    max_retry_time = timedelta(minutes=5 if os.getenv("CI") else 1)
    retry_sleep_secs = 30 if os.getenv("CI") else 5

Interesting... I guess this is tox masking the environment?