Do we need securesystemslib?

[kenodegard]

What happened?

securesystemslib was only recently added to conda-forge and is not available on defaults. In other words, this feature has not been in use outside of development/testing.

Do we need to continue to offer this functionality?

[mohanavamsi20]

It can be usefull for future references or experiment.

[chenghlee]

It's "needed" for operations like signing the trust roots.

However, I'd argue that the trust metadata signing and management should be re-factored into a separate package/utility, and conda-content-trust be re-scoped to only be the client-side trust verification component. And in that case, securesystemslib shouldn't be needed as a dependency, as any other, trustworthy package that supports Ed25519 verification would work.

[github-actions]

Hi there, thank you for your contribution!

This issue has been automatically marked as stale because it has not had recent activity. It will be closed automatically if no further activity occurs.

If you would like this issue to remain open please:

1. Verify that you can still reproduce the issue at hand
2. Comment that the issue is still reproducible and include:
   - What OS and version you reproduced the issue on
   - What steps you followed to reproduce the issue

NOTE: If this issue was closed prematurely, please leave a comment.

Thanks!