Update dependency sigstore/cosign to v2.6.4

GitLab Dependency Botrequested to merge
gitlab-renovate-forks/opentofu:renovate/sigstore-cosign-2.x into main

This MR contains the following updates:

Package Update Change
sigstore/cosign patch 2.6.3 -> 2.6.4

⚠️ Warning

Some dependencies could not be looked up. Check the warning logs for more information.

MR created with the help of gitlab-org/frontend/renovate-gitlab-bot

Release Notes

sigstore/cosign (sigstore/cosign)

v2.6.4

Compare Source

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

  • 26261f0 Allow attestation download to handle both bundle types (#​4996) (#​5017)
  • d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick MR-4997 to release-2.6) (#​5002)
Thanks to all contributors!

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports