chore(deps): update dependency sigstore/cosign to v2.4.0

[renovate]

This PR contains the following updates:

Package	Update	Change
sigstore/cosign	minor	v2.2.4 -> v2.4.0

---

Release Notes

sigstore/cosign (sigstore/cosign)

v2.4.0

Compare Source

v2.4.0 begins the modernization of the Cosign client, which includes:

• Support for the newer Sigstore specification-compliant bundle format
• Support for providing trust roots (e.g. Fulcio certificates, Rekor keys)
  through a trust root file, instead of many different flags
• Conformance test suite integration to verify signing and verification behavior

In future updates, we'll include:

• General support for the trust root file, instead of only when using the bundle
  format during verification
• Simplification of trust root flags and deprecation of the
  Cosign-specific bundle format
• Bundle support with container signing

We have also moved nightly Cosign container builds to GHCR instead of GCR.

Features

• Add new bundle support to verify-blob and verify-blob-attestation (#​3796)
• Adding protobuf bundle support to sign-blob and attest-blob (#​3752)
• Bump sigstore/sigstore to support email_verified as string or boolean (#​3819)
• Conformance testing for cosign (#​3806)
• move incremental builds per commit to GHCR instead of GCR (#​3808)
• Add support for recording creation timestamp for cosign attest (#​3797)
• Include SCT verification failure details in error message (#​3799)

Contributors

• Bob Callaway
• Hayden B
• Slavek Kabrda
• Zach Steindler
• Zsolt Horvath

v2.3.0

Compare Source

Features

• Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#​3693)
• add registry options to cosign save (#​3645)
• Add debug providers command. (#​3728)
• Make config layers in ociremote mountable (#​3741)
• upgrade to go1.22 (#​3739)
• adds tsa cert chain check for env var or tuf targets. (#​3600)
• add --ca-roots and --ca-intermediates flags to 'cosign verify' (#​3464)
• add handling of keyless verification for all verify commands (#​3761)

Bug Fixes

• fix: close attestationFile (#​3679)
• Set bundleVerified to true after Rekor verification (Resolves #​3740) (#​3745)

Documentation

• Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#​3776)

Testing

• Refactor KMS E2E tests (#​3684)
• Remove sign_blob_test.sh test (#​3707)
• Remove KMS E2E test script (#​3702)
• Refactor insecure registry E2E tests (#​3701)

Contributors

• Billy Lynch
• bminahan73
• Bob Callaway
• Carlos Tadeu Panato Junior
• Cody Soyland
• Colleen Murphy
• Dmitry Savintsev
• guangwu
• Hayden B
• Hector Fernandez
• ian hundere
• Jason Power
• Jon Johnson
• Max Lambrecht
• Meeki1l

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.