Bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2

[dependabot]

Bumps github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2.

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.2

This may be the last Cosign v3.1 release, as we finish deprecations and removing unused functionality. Soon we'll start work on Cosign v4 where we will remove things that are currently deprecated. We'll continue to support Cosign v3, with it's opt-in backwards compatibility, as described in our versioning policy.

If you haven't already, now is an excellent time to move to the bundle format that has been supported since Cosign v2.6.

We have received a ton of fixes over the past month from folks using Cosign in a variety of environments - thank you all!

Deprecations

• 816f2b6634821cefe6ceabbffdd5ff7ffc00d0a4 Deprecate --payload for sign and verify commands (#4991)

Features

• 5121398c0ae6f4444d8ffd10447d7b765184f304 docs: add OVHcloud KMS in available external plugins (#4962)
• 38f73bb8fd949fad71e7086bd122080b2d47ceeb Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
• 2e0749ac11c7326299f6af65ae6a3ab6a6750586 Deprecate --output-attestation (#4958)
• 2233166935e2940a530e5a740adc095f4ca4863d Add bundle inspect command (#4842)

Fixes

• eb3bb86f712a1163591b6663bbc434afb6fad467 Guard against empty certificate PEM in mutate.Signature (#4998)
• 089731c31f750153e9d91ec248c990e3b1991c2b fix(download): Validate predicate type for new bundle format
• d996ce12df6967bb5bf81e3244bfbbe1c2665f34 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
• 8ca5b2002f5cd43614c476665e2055e59392b59d Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
• df78bf67985f09e431f88b69be5842b7d0f5f4eb fix(verify): skip identity validation for security keys (#5012)
• aebdc3a232083841b9c957fbba6b80b41df8caad fix: include artifactType in OCI 1.1 signature referrer manifest
• c0edaac063a90b1dcacdabc7fc23e6c6f8ade90d Allow attestation download to handle both bundle types (#4996)
• a8642c7b8611d557b4a592e6b94b188bd9427d7c Fix panic in dockerfile verify on malformed FROM lines (#4979)
• ef3e3b446a011852929a08f51095ecc67495bfe7 fix(release): restore signing-step auth and fail on image signing errors (#4978)
• 16ddbcf9040b75e2329f2436b65ba3ed340dac88 feat(signing-config): add --base-config flag to override services from base config (#4977)
• f17f812494b558499d89a37a6c9161657d2371e9 fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
• 6ef8d9d040a481e26e065349c292799615ea7e7b fix: ignore build stage references in dockerfile verify (#4961)
• 8dbdef561622178f453d64d83faa02b1744a19f7 fix: allow '=' in annotation values (#4957)

Cleanup

• 193d2153431f8bb0d945a4c1ee721872f73add67 Remove unused policy evaluation code (#4936)
• 0fc9811059a037c32599e133ec4cc9fead4f354e Remove unused signing code (#4918)
• 95dceda0e7ea0b8d1f1a1d2b9a98c9fb2a6e5b74 Remove unused OCI code (#4935)
• b1dd2e9524daf7406b350cbbfa7f4cd7b8ea0973 Remove unused ephemeral signer (#4938)

Documentation

• 81841260820bdddef3ea65c6f0824caca0cf2715 feat: improve verify flag shell completions (#4965)
• ed0efe8cb464c1bae4711f87b552b1f2e602c816 docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
• d41b86c63cfd2653c263962a9225691c5774c228 docs: add Example fields to env and bundle create commands (#4941)
• 8a7174a1d462b3bb5a2722c7e1cf3a24fd1d3896 docs: fix Short style and add Example fields to pkcs11-tool subcommands

Thanks to all contributors!

... (truncated)

Commits

• 193d215 Remove unused policy evaluation code (#4936)
• eb3bb86 Guard against empty certificate PEM in mutate.Signature (#4998)
• 089731c fix(download): Validate predicate type for new bundle format
• d996ce1 Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
• 8ca5b20 Fix Makefile: fall back to "unknown" version info when built outside a git re...
• df78bf6 fix(verify): skip identity validation for security keys (#5012)
• ee51b53 chore(deps): bump golang in the all group across 1 directory (#4950)
• aebdc3a fix: include artifactType in OCI 1.1 signature referrer manifest
• 816f2b6 Deprecate --payload for sign and verify commands (#4991)
• c0edaac Allow attestation download to handle both bundle types (#4996)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)