Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 (#506)

Bumps
[github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from
2.4.3 to 2.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign/releases">github.com/sigstore/cosign/v2's
releases</a>.</em></p>
<blockquote>
<p>v2.5.0 includes an implementation of the new bundle specification,
attesting and verifying OCI image attestations uploaded as OCI
artifacts.
This feature is currently gated behind the
<code>--new-bundle-format</code> flag
when running <code>cosign attest</code>.</p>
<h2>Features</h2>
<ul>
<li>Add support for new bundle specification for attesting/verifying OCI
image attestations (<a
href="https://redirect.github.com/sigstore/cosign/issues/3889">#3889</a>)</li>
<li>Feat/non filename completions (<a
href="https://redirect.github.com/sigstore/cosign/issues/4115">#4115</a>)</li>
<li>Add TSA certificate related flags and fields for cosign attest (<a
href="https://redirect.github.com/sigstore/cosign/issues/4079">#4079</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>cmd/cosign/cli: fix typo in ignoreTLogMessage (<a
href="https://redirect.github.com/sigstore/cosign/issues/4111">#4111</a>)</li>
<li>Fix replace with compliant image mediatype (<a
href="https://redirect.github.com/sigstore/cosign/issues/4077">#4077</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign/blob/main/CHANGELOG.md">github.com/sigstore/cosign/v2's
changelog</a>.</em></p>
<blockquote>
<h1>v2.5.0</h1>
<p>v2.5.0 includes an implementation of the new bundle specification,
attesting and verifying OCI image attestations uploaded as OCI
artifacts.
This feature is currently gated behind the
<code>--new-bundle-format</code> flag
when running <code>cosign attest</code>.</p>
<h2>Features</h2>
<ul>
<li>Add support for new bundle specification for attesting/verifying OCI
image attestations (<a
href="https://redirect.github.com/sigstore/cosign/issues/3889">#3889</a>)</li>
<li>Feat/non filename completions (<a
href="https://redirect.github.com/sigstore/cosign/issues/4115">#4115</a>)</li>
<li>Add TSA certificate related flags and fields for cosign attest (<a
href="https://redirect.github.com/sigstore/cosign/issues/4079">#4079</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>cmd/cosign/cli: fix typo in ignoreTLogMessage (<a
href="https://redirect.github.com/sigstore/cosign/issues/4111">#4111</a>)</li>
<li>Fix replace with compliant image mediatype (<a
href="https://redirect.github.com/sigstore/cosign/issues/4077">#4077</a>)</li>
</ul>
<h2>Contributors</h2>
<ul>
<li>Bob Callaway</li>
<li>Carlos Tadeu Panato Junior</li>
<li>Cody Soyland</li>
<li>Dmitry Savintsev</li>
<li>Hayden B</li>
<li>Ramon Petgrave</li>
<li>Riccardo Schirone</li>
<li>Stef Graces</li>
<li>Ville Skyttä</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/cosign/commit/38bb98697005cdc5c092f031594c0e45d039f4a0"><code>38bb986</code></a>
chore(deps): bump cuelang.org/go in the gomod group across 1 directory
(<a
href="https://redirect.github.com/sigstore/cosign/issues/4154">#4154</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/076da852923f0ca5619ff998e2546a4c2acabe51"><code>076da85</code></a>
chore(deps): bump gitlab.com/gitlab-org/api/client-go (<a
href="https://redirect.github.com/sigstore/cosign/issues/4149">#4149</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/e7099da7a62ad53d1201a6f0dd169ccb248125e8"><code>e7099da</code></a>
chore(deps): bump github.com/buildkite/agent/v3 from 3.93.1 to 3.95.1
(<a
href="https://redirect.github.com/sigstore/cosign/issues/4139">#4139</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/c351ca819ac6eb3daeb7fc98dff9a16791fcac0b"><code>c351ca8</code></a>
chore(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.29.0 (<a
href="https://redirect.github.com/sigstore/cosign/issues/4147">#4147</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/76d23ba9de3ce8e98c062925aa9ea1d2fe64e766"><code>76d23ba</code></a>
Update sigstore-go to pick up bug fixes (<a
href="https://redirect.github.com/sigstore/cosign/issues/4150">#4150</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/c6c96ea4c99fa441e77a39b79d3024f931ddf9f6"><code>c6c96ea</code></a>
chore(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0 (<a
href="https://redirect.github.com/sigstore/cosign/issues/4148">#4148</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/6e7a9f9568acbb361fba7ba0364ab782ecfa2376"><code>6e7a9f9</code></a>
Update golangci-lint to v2, update golangci-lint-action (<a
href="https://redirect.github.com/sigstore/cosign/issues/4143">#4143</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/37bae90768f66c930b5630d0f570778141878737"><code>37bae90</code></a>
Feat/non filename completions (<a
href="https://redirect.github.com/sigstore/cosign/issues/4115">#4115</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/4c329965c5987c922b0fcd3f67a131f2e88eb337"><code>4c32996</code></a>
chore(deps): bump the gomod group with 5 updates (<a
href="https://redirect.github.com/sigstore/cosign/issues/4129">#4129</a>)</li>
<li><a
href="https://github.com/sigstore/cosign/commit/11b12fa69e282e225446ddf9282aa81b63e6ab46"><code>11b12fa</code></a>
chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (<a
href="https://redirect.github.com/sigstore/cosign/issues/4125">#4125</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sigstore/cosign/compare/v2.4.3...v2.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/cosign/v2&package-manager=go_modules&previous-version=2.4.3&new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/hashicorp/terraform-plugin-go v0.26.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0
 	github.com/hashicorp/terraform-plugin-testing v1.12.0
-	github.com/sigstore/cosign/v2 v2.4.3
+	github.com/sigstore/cosign/v2 v2.5.0
 	golang.org/x/sync v0.13.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/apimachinery v0.32.3
@@ -52,6 +52,8 @@ require (
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
+	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/cli v27.5.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
@@ -63,6 +65,7 @@ require (
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/fatih/color v1.16.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.8.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
@@ -73,22 +76,24 @@ require (
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
-	github.com/go-openapi/errors v0.22.0 // indirect
+	github.com/go-openapi/errors v0.22.1 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/loads v0.22.0 // indirect
 	github.com/go-openapi/runtime v0.28.0 // indirect
 	github.com/go-openapi/spec v0.21.0 // indirect
 	github.com/go-openapi/strfmt v0.23.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/certificate-transparency-go v1.3.1 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.5 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
 	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99 // indirect
@@ -114,6 +119,8 @@ require (
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/in-toto/attestation v1.1.1 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20241212093149-d2f9f49435c7 // indirect
@@ -141,30 +148,42 @@ require (
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/package-url/packageurl-go v0.1.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/prometheus/client_golang v1.21.1 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/psanford/memfs v0.0.0-20241019191636-4ef911798f9b // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/sagikazarmark/locafero v0.7.0 // indirect
 	github.com/sassoftware/relic v7.2.1+incompatible // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sigstore/protobuf-specs v0.4.0 // indirect
+	github.com/sigstore/protobuf-specs v0.4.1 // indirect
 	github.com/sigstore/rekor v1.3.9 // indirect
-	github.com/sigstore/sigstore v1.8.15 // indirect
+	github.com/sigstore/sigstore v1.9.1 // indirect
+	github.com/sigstore/sigstore-go v0.7.1 // indirect
+	github.com/sigstore/timestamp-authority v1.2.5 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.12.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
 	github.com/spf13/cobra v1.9.1 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/viper v1.20.1 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/theupdateframework/go-tuf v0.7.0 // indirect
+	github.com/theupdateframework/go-tuf/v2 v2.0.2 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/transparency-dev/merkle v0.0.2 // indirect
 	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
@@ -182,29 +201,29 @@ require (
 	go.opentelemetry.io/otel v1.35.0 // indirect
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.step.sm/crypto v0.59.1 // indirect
+	go.step.sm/crypto v0.60.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/crypto v0.37.0 // indirect
 	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac // indirect
-	golang.org/x/mod v0.23.0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
 	golang.org/x/net v0.39.0 // indirect
-	golang.org/x/oauth2 v0.28.0 // indirect
+	golang.org/x/oauth2 v0.29.0 // indirect
 	golang.org/x/sys v0.32.0 // indirect
 	golang.org/x/term v0.31.0 // indirect
 	golang.org/x/text v0.24.0 // indirect
 	golang.org/x/time v0.11.0 // indirect
 	golang.org/x/tools v0.30.0 // indirect
-	google.golang.org/api v0.225.0 // indirect
+	google.golang.org/api v0.227.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
 	google.golang.org/grpc v1.71.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	sigs.k8s.io/release-utils v0.11.0 // indirect
+	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
+	sigs.k8s.io/release-utils v0.11.1 // indirect
 )