Upgrade tuf dependency to 4.0 (#135)

although the tuf api changes in 4.0 don't appear to affect us on the repo side,
there is a breaking change in the client due to our use of the private tuf.ngclient.Updater_trusted_set

see theupdateframework/python-tuf@cb9aa4a

* upgrade python-tuf dependency to 4.0+

* adapt tufup.client.Client to changes in tuf.ngclient.Updater._trusted_set

pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
  "packaging>=21.3",
  "securesystemslib[crypto,pynacl]>=0.26.0",
  "setuptools>=65.5.1",
- "tuf==3.1.*",
+ "tuf==4.0.*",
  # constraints on sub-dependencies
  "certifi>=2022.12.7",
  "cryptography>=38.0.3",

src/tufup/client.py

@@ -70,7 +70,7 @@ def trusted_target_metas(self) -> list:
  if self._trusted_set.targets:
  _trusted_target_metas = [
  TargetMeta(target_path=key, custom=target.custom)
- for key, target in self._trusted_set.targets.signed.targets.items()
+ for key, target in self._trusted_set.targets.targets.items()
  ]
  logger.debug(f'{len(_trusted_target_metas)} TargetMeta objects created')
  else: