Update module github.com/sigstore/cosign to v1.10.0

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/sigstore/cosign	require	minor	v1.9.0 -> v1.10.0

---

Release Notes

sigstore/cosign

v1.10.0

Compare Source

Enhancements

• Add env subcommand. (https://github.com/sigstore/cosign/pull/2051)
• feat: cert-extensions verify (https://github.com/sigstore/cosign/pull/1626)
• sign-blob: bundle should work independently (https://github.com/sigstore/cosign/pull/2016)
• Add --oidc-provider flag to specify which provider to use for ambient credentials (https://github.com/sigstore/cosign/pull/1998)
• Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore (https://github.com/sigstore/cosign/pull/1866)
• Add --platform flag to cosign sbom download (https://github.com/sigstore/cosign/pull/1975)
• Route deprectated -version to subcommand (https://github.com/sigstore/cosign/pull/1854)
• Add cyclonedx predicate type for attestations (https://github.com/sigstore/cosign/pull/1977)
• Updated Azure kms commands. (https://github.com/sigstore/cosign/pull/1972)
• Add spdxjson predicate type for attestations (https://github.com/sigstore/cosign/pull/1974)
• Drop tuf client dependency on GCS client library (https://github.com/sigstore/cosign/pull/1967)
• feat(fulcioroots): singleton error pattern (https://github.com/sigstore/cosign/pull/1965)
• tuf: improve TUF client concurrency and caching (https://github.com/sigstore/cosign/pull/1953)
• Separate RegExp matching of issuer/subject from strict (https://github.com/sigstore/cosign/pull/1956)

Documention

• update design doc link (https://github.com/sigstore/cosign/pull/2077)
• specs: fix list formatting on SIGNATURE_SPEC (https://github.com/sigstore/cosign/pull/2030)
• public-key: fix command description (https://github.com/sigstore/cosign/pull/2024)
• docs(readme): add installation steps for container image for cosign binary (https://github.com/sigstore/cosign/pull/1986)
• Add Cloudsmith Container Registry to tested registry list (https://github.com/sigstore/cosign/pull/1966)

Bug Fixes

• Fix OIDC test (https://github.com/sigstore/cosign/pull/2050)
• Use cosign.ConfirmPrompt more consistently (https://github.com/sigstore/cosign/pull/2039)
• chore: add note about SIGSTORE_REKOR_PUBLIC_KEY (https://github.com/sigstore/cosign/pull/2040)
• Fix #​1378 create new attestation signature in replace mode if not existent (https://github.com/sigstore/cosign/pull/2014)
• encrypt values to create the github action secret (https://github.com/sigstore/cosign/pull/1990)
• fix/update post build job (https://github.com/sigstore/cosign/pull/1983)
• fix typos (https://github.com/sigstore/cosign/pull/1982)

Others

• Bump github.com/hashicorp/vault/sdk from 0.5.2 to 0.5.3 (https://github.com/sigstore/cosign/pull/2079)
• Bump github.com/go-openapi/strfmt from 0.21.2 to 0.21.3 (https://github.com/sigstore/cosign/pull/2078)
• Bump google.golang.org/api from 0.87.0 to 0.88.0 (https://github.com/sigstore/cosign/pull/2081)
• Remove hack/tools.go (https://github.com/sigstore/cosign/pull/2080)
• Remove replace directives in go.mod. (https://github.com/sigstore/cosign/pull/2070)
• Bump mikefarah/yq from 4.25.3 to 4.26.1 (https://github.com/sigstore/cosign/pull/2076)
• Bump github.com/xanzy/go-gitlab from 0.68.2 to 0.69.0 (https://github.com/sigstore/cosign/pull/2075)
• Bump actions/dependency-review-action from 2.0.2 to 2.0.4 (https://github.com/sigstore/cosign/pull/2073)
• Bump google.golang.org/api from 0.86.0 to 0.87.0 (https://github.com/sigstore/cosign/pull/2064)
• chore(deps): CycloneDX PredicateType changed to use in-toto-golang (https://github.com/sigstore/cosign/pull/2067)
• Bump github.com/open-policy-agent/opa from 0.42.0 to 0.42.2 (https://github.com/sigstore/cosign/pull/2063)
• Bump google.golang.org/grpc from 1.47.0 to 1.48.0 (https://github.com/sigstore/cosign/pull/2062)
• Bump actions/setup-go from 3.2.0 to 3.2.1 (https://github.com/sigstore/cosign/pull/2060)
• Bump github/codeql-action from 2.1.15 to 2.1.16 (https://github.com/sigstore/cosign/pull/2065)
• Bump actions/cache from 3.0.4 to 3.0.5 (https://github.com/sigstore/cosign/pull/2066)
• update to go 1.18 (https://github.com/sigstore/cosign/pull/2059)
• Bump github.com/open-policy-agent/opa from 0.35.0 to 0.42.0 (https://github.com/sigstore/cosign/pull/2046)
• update ct/otel and etcd (https://github.com/sigstore/cosign/pull/2054)
• remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 (https://github.com/sigstore/cosign/pull/2055)
• Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 (https://github.com/sigstore/cosign/pull/2042)
• Bump github.com/hashicorp/go-version from 1.5.0 to 1.6.0 (https://github.com/sigstore/cosign/pull/2032)
• Bump github.com/spiffe/go-spiffe/v2 from 2.1.0 to 2.1.1 (https://github.com/sigstore/cosign/pull/2037)
• Bump github/codeql-action from 2.1.14 to 2.1.15 (https://github.com/sigstore/cosign/pull/2038)
• Bump google.golang.org/api from 0.85.0 to 0.86.0 (https://github.com/sigstore/cosign/pull/2036)
• Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 (https://github.com/sigstore/cosign/pull/2035)
• Bump ossf/scorecard-action from 1.1.1 to 1.1.2 (https://github.com/sigstore/cosign/pull/2033)
• Bump github.com/xanzy/go-gitlab from 0.68.0 to 0.68.2 (https://github.com/sigstore/cosign/pull/2029)
• Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 (https://github.com/sigstore/cosign/pull/2026)
• Attempt to clean up pkg/cosign (https://github.com/sigstore/cosign/pull/2018)
• Bump github/codeql-action from 2.1.13 to 2.1.14 (https://github.com/sigstore/cosign/pull/2023)
• Bump github.com/google/go-containerregistry from 0.9.0 to 0.10.0 (https://github.com/sigstore/cosign/pull/2021)
• Bump mikefarah/yq from 4.25.2 to 4.25.3 (https://github.com/sigstore/cosign/pull/2022)
• Bump google.golang.org/api from 0.84.0 to 0.85.0 (https://github.com/sigstore/cosign/pull/2015)
• Bump github.com/stretchr/testify from 1.7.3 to 1.7.4 (https://github.com/sigstore/cosign/pull/2010)
• Bump github.com/google/go-github/v45 from 45.1.0 to 45.2.0 (https://github.com/sigstore/cosign/pull/2011)
• Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 (https://github.com/sigstore/cosign/pull/2012)
• Bump github/codeql-action from 2.1.12 to 2.1.13 (https://github.com/sigstore/cosign/pull/2013)
• Bump github.com/stretchr/testify from 1.7.2 to 1.7.3 (https://github.com/sigstore/cosign/pull/2009)
• Bump actions/dependency-review-action from 2.0.1 to 2.0.2 (https://github.com/sigstore/cosign/pull/2001)
• Bump github.com/hashicorp/vault/sdk from 0.5.1 to 0.5.2 (https://github.com/sigstore/cosign/pull/1996)
• Bump actions/dependency-review-action from 1.0.2 to 2.0.1 (https://github.com/sigstore/cosign/pull/2000)
• Bump google.golang.org/api from 0.83.0 to 0.84.0 (https://github.com/sigstore/cosign/pull/1999)
• Bump sigstore/sigstore to HEAD (https://github.com/sigstore/cosign/pull/1995)
• Bump github.com/hashicorp/vault/sdk from 0.5.0 to 0.5.1 (https://github.com/sigstore/cosign/pull/1988)
• cleanup ci job and remove policy-controller references (https://github.com/sigstore/cosign/pull/1981)
• Bump google.golang.org/api from 0.82.0 to 0.83.0 (https://github.com/sigstore/cosign/pull/1979)
• cleanup: unexport kubernetes.Client method (https://github.com/sigstore/cosign/pull/1973)
• Remove policy-controller now that it lives in sigstore/policy-controller (https://github.com/sigstore/cosign/pull/1976)
• Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 (https://github.com/sigstore/cosign/pull/1980)
• Bump actions/cache from 3.0.3 to 3.0.4 (https://github.com/sigstore/cosign/pull/1970)
• Bump github.com/hashicorp/go-hclog from 1.2.0 to 1.2.1 (https://github.com/sigstore/cosign/pull/1968)
• Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 (https://github.com/sigstore/cosign/pull/1963)
• Bump google.golang.org/grpc from 1.46.2 to 1.47.0 (https://github.com/sigstore/cosign/pull/1943)
• Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.5 to 0.1.6 (https://github.com/sigstore/cosign/pull/1958)
• replace gcr.io/distroless/ to use ghcr.io/distroless/ (https://github.com/sigstore/cosign/pull/1961)
• Bump github/codeql-action from 2.1.11 to 2.1.12 (https://github.com/sigstore/cosign/pull/1951)
• Bump google.golang.org/api from 0.81.0 to 0.82.0 (https://github.com/sigstore/cosign/pull/1948)

Contributors

• Adolfo García Veytia (@​puerco)
• Asra Ali (@​asraa)
• Batuhan Apaydın (@​developer-guy)
• Billy Lynch (@​wlynch)
• Bob Callaway (@​bobcallaway)
• Carlos Tadeu Panato Junior (@​cpanato)
• Ciara Carey (@​ciaracarey)
• Frederik Boster (@​Syquel)
• Furkan Türkal (@​Dentrax)
• Hector Fernandez (@​hectorj2f)
• Jason Hall (@​imjasonh)
• Jinhong Brejnholt (@​JBrejnholt)
• Josh Dolitsky (@​jdolitsky)
• Masahiro331 (@​masahiro331)
• Priya Wadhwa (@​priyawadhwa)
• Ville Aikas (@​vaikas)
• William Woodruff (@​woodruffw)

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.