Cannot refresh metadata: root was signed by 0/1 keys (tufup)

Question

I use tufup package to implement automatic updates for Python application. However, I don't understand signing part at all. I read Roles and metadata section in TUF website but I still don't understand the process. When / what / how should I sign metadata files?

This is what I do:

1. Initialize the repository.
2. Build application, version 1.0.0, with pyinstaller (root.json is also included with the application).
3. Add bundle to TUF repository.
4. Start HTTP server to serve repository files.
5. Change something in the application, update version number and build it again (version 1.0.1).
6. Add bundle to TUF repository and it creates a patch file.
7. Start the application built in step 1 (version 1.0.0).

I use tufup Client to check for updates on start-up. It does not find any and outputs an error message, for example, "Cannot refresh metadata: root was signed by 0/1 keys". Sometimes it's "timestamp" instead of "root". I tried signing root, targets, timestamp with command, for example, tufup sign -e 365 root <path to keystore>. I have no idea when signing should happen and what should I sign.