chore(deps): update dependency cosign to v3.0.6

[botty-mcbottington]

This PR contains the following updates:

Package	Update	Change
cosign	patch	3.0.4 → 3.0.6

---

Release Notes

sigstore/cosign (cosign)

v3.0.6

Changelog

v3.0.6 resolves GHSA-w6c6-c85g-mmv6. This release also adds support for signing with OpenBao-managed keys.

• f1ad3ee Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#​4801)
• a09afa9 Handle whitespace-only certificate annotation (#​4760)
• 5a38a6d fix(sign): closing SignerVerifier too early when signing with a security key (#​4761)
• 2290a59 Disallow --new-bundle-format and --rfc3161-timestamp (#​4762)
• 36f4008 support managed keys in conformance testing (#​4728)
• 3274cf9 Add support for GCE metadata server env var (#​4732)
• 2e9754a fix: preserve per-layer annotations in WriteAttestationsReferrer (#​4709)
• dece275 Fix parsing of in-toto for string predicates
• bd4f0fd Mark batch of flags for deprecation (#​4698)
• 9b259ff disallow key and cert identity being used together during verification (#​4636)
• 95eb1c3 support key creation in GitLab group (#​4704)

Thanks to all contributors!

v3.0.5

Deprecations

• Deprecate rekor-entry-type flag (#​4691)
• Deprecate cosign triangulate (#​4676)
• Deprecate cosign copy (#​4681)

Features

• Automatically require signed timestamp with Rekor v2 entries (#​4666)
• Allow --local-image with --new-bundle-format for v2 and v3 signatures (#​4626)
• Add mTLS support for TSA client connections when signing with a signing config (#​4620)
• Enforce TSA requirement for Rekor v2, Fuclio signing (#​4683)

Bug Fixes

• Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#​4635)
• fix: avoid panic on malformed attestation payload (#​4651)
• fix: avoid panic on malformed tlog entries (#​4649)
• fix: avoid panic on malformed replace payload (#​4653)
• Gracefully fail if bundle payload body is not a string (#​4648)
• Verify validity of chain rather than just certificate (#​4663)
• fix: avoid panic on malformed tlog entry body (#​4652)

Documentation

• docs(cosign): clarify RFC3161 revocation semantics (#​4642)
• Fix typo in CLI help (#​4701)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.16%. Comparing base (f29a6d4) to head (af01f61).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #301   +/-   ##
=======================================
  Coverage   45.16%   45.16%           
=======================================
  Files          53       53           
  Lines        4886     4886           
=======================================
  Hits         2207     2207           
  Misses       2523     2523           
  Partials      156      156           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.