Closed
Description
Description of issue or feature request:
Automate releases to reduce potential for human error and protect against developer machine compromise.
Current behavior:
Current release process is very manual and runs on the local machine of a developer making the release: https://github.com/theupdateframework/tuf/blob/7731738590f291041c06b3c525e248d245cb1f33/docs/RELEASE.md
Expected behavior:
Release process is automated as much as possible and, ideally, happens in a hermetic environment on a hosted build service.
At a minimum we should script releases, but even better would be to define a plan to meet SLSA 2 or above https://slsa.dev/levels