Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0

[dependabot[bot]]

Bumps github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0.

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.3.0

Features

• Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
• add registry options to cosign save (#3645)
• Add debug providers command. (#3728)
• Make config layers in ociremote mountable (#3741)
• upgrade to go1.22 (#3739)
• adds tsa cert chain check for env var or tuf targets. (#3600)
• add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
• add handling of keyless verification for all verify commands (#3761)

Bug Fixes

• fix: close attestationFile (#3679)
• Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)

Documentation

• Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)

Testing

• Refactor KMS E2E tests (#3684)
• Remove sign_blob_test.sh test (#3707)
• Remove KMS E2E test script (#3702)
• Refactor insecure registry E2E tests (#3701)

Contributors

• Billy Lynch
• bminahan73
• Bob Callaway
• Carlos Tadeu Panato Junior
• Cody Soyland
• Colleen Murphy
• Dmitry Savintsev
• guangwu
• Hayden B
• Hector Fernandez
• ian hundere
• Jason Power
• Jon Johnson
• Max Lambrecht
• Meeki1l

Full Changelog: https://github.com/sigstore/cosign/compare/v2.2.4...v2.3.0

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.3.0

Features

• Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
• add registry options to cosign save (#3645)
• Add debug providers command. (#3728)
• Make config layers in ociremote mountable (#3741)
• upgrade to go1.22 (#3739)
• adds tsa cert chain check for env var or tuf targets. (#3600)
• add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
• add handling of keyless verification for all verify commands (#3761)

Bug Fixes

• fix: close attestationFile (#3679)
• Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)

Documentation

• Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)

Testing

• Refactor KMS E2E tests (#3684)
• Remove sign_blob_test.sh test (#3707)
• Remove KMS E2E test script (#3702)
• Refactor insecure registry E2E tests (#3701)

Contributors

• Billy Lynch
• bminahan73
• Bob Callaway
• Carlos Tadeu Panato Junior
• Cody Soyland
• Colleen Murphy
• Dmitry Savintsev
• guangwu
• Hayden B
• Hector Fernandez
• ian hundere
• Jason Power
• Jon Johnson
• Max Lambrecht
• Meeki1l

Commits

• deed363 chore(deps): bump github.com/xanzy/go-gitlab from 0.106.0 to 0.107.0 (#3792)
• c6f89f8 chore(deps): bump github.com/buildkite/agent/v3 from 3.74.1 to 3.75.1 (#3793)
• aeba473 Add CHANGELOG for v2.3.0 (#3789)
• 20d4724 chore(deps): bump github.com/google/go-containerregistry (#3790)
• 4684fd6 chore(deps): bump the gomod group with 5 updates (#3780)
• 3c6c5c9 chore(deps): bump github.com/sigstore/fulcio from 1.4.5 to 1.5.1 (#3784)
• 05026ee chore(deps): bump github.com/google/go-containerregistry (#3783)
• f9270c0 chore(deps): bump google.golang.org/api from 0.187.0 to 0.188.0 (#3782)
• 4fd699c chore(deps): bump go.step.sm/crypto from 0.48.1 to 0.50.0 (#3781)
• 13d3a56 chore(deps): bump the actions group across 1 directory with 2 updates (#3785)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[k4leung4]

@dependabot rebase

[dependabot[bot]]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[k4leung4]

@dependabot recreate

[k4leung4]

@dependabot rebase

[dependabot[bot]]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.