Hi! Thanks for reporting. We did do a reverse deps build test before upload (https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf/-/pipelines/1196043) and both sigstore packages built fine. Interesting to learn that this distrobuilder was also dependant of it.
Juan: Can you look into it?
