Description

tuf.URLToPath trims the https:// prefix of a URL and replaces other /s with - to be POSIX-safe when the output is used as a directory name. This does not work on Windows if the URL starts with http:// or uses a nonstandard port, both of which can occur in tests.

See this test run on Windows as an example: https://github.com/cmurphy/sigstore-go/actions/runs/13270875530/job/37049712149

This affects the cosign unit tests as we try to implement sigstore/cosign#3548.

Version

5008d5c