Bump in-toto dependency.

[mattmoor]

I noticed that there were some breaking changes in the in-toto version pulled in compared with the version in sigstore. This updates things to HEAD.

[mattmoor]

cc @priyawadhwa @dlorenc

[mattmoor]

Hmm...

tekton-chains-controller-7f4d9cc466-4mrdl   0/1   CrashLoopBackOff   5     5m10s

[mattmoor]

Hello old friend:

kubectl logs -n tekton-chains      tekton-chains-controller-5bcfbf8484-rmk46
/ko-app/controller flag redefined: log_dir
panic: /ko-app/controller flag redefined: log_dir

[mattmoor]

Looks like chains is depending on the cli package, which pulls in glog (conflicts with K8s klog).

The two things I found that need to move out to make a depcheck_test pass for chains are:

• cli.LoadECDSAPrivateKey
• cli.DssePayloadType

I will look into splitting these out in the morning (unless someone beats me to it!)

EDIT: This is an example of the depcheck I added to sigstore when the cosigned webhook was hitting a similar problem: https://github.com/sigstore/cosign/blob/main/cmd/cosign/webhook/depcheck_test.go

[mattmoor]

Ok, I am optimistic that this will pass, but I had to tweak an e2e test to reflect a change pulled in via the updated deps.

[mattmoor]

@priyawadhwa LMK if this is expected, but this seems to be what the provenance type changed to in in-toto 🤷

[dlorenc]

this is expected

[dlorenc]

/lgtm

[dlorenc]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dlorenc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dlorenc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mattmoor]

Merge conflict, fixing it now

[mattmoor]

Rebased on main and updated deps, but I'll need a fresh /lgtm

[priyawadhwa]

/lgtm