Bump sigstore/cosign-installer from 4.0.0 to 4.1.1; Always use latest version of cosign; Wait 30s between signing and verifying signature

[dependabot]

Bumps sigstore/cosign-installer from 4.0.0 to 4.1.1.

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.1

What's Changed

• chore: update default cosign-release to v3.0.5 in sigstore/cosign-installer#223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

• Bump cosign to 3.0.5 in sigstore/cosign-installer#220
• fix: add retry to curl downloads for transient network failures in sigstore/cosign-installer#210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

Commits

• cad07c2 chore: update default cosign-release to v3.0.5 (#223)
• ba7bc0a fix: add retry to curl downloads for transient network failures (#210)
• 5a292e1 Bump cosign to 3.0.5 (#220)
• 351ea76 Bump actions/checkout from 6.0.1 to 6.0.2 (#217)
• c17565f test with go 1.26 too (#221)
• a6fdd19 Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)
• 430b6a7 docs: fix registry from gcr.io to ghcr.io (#213)
• 4d14d7f feat: update to v3.0.3 (#212)
• f148005 fix: use env vars for template expansions; show curl errors (#207)
• c3f2d79 Bump actions/checkout from 6.0.0 to 6.0.1 (#208)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[the-glu]

@mickmis I tested in #1406 and it does seems to sign correctly, not sure what was failing before, do you know?

[mickmis]

@mickmis I tested in #1406 and it does seems to sign correctly, not sure what was failing before, do you know?

My memory is a bit vague, but I remember that it was due to some subcommands of the CLI binary not being yet compatible with the new formats. So it is very likely that this got fixed in the meantime. Have you managed to verify the signature as well?
But if both signing and verifying are fine, we can go ahead with the upgrade :)

[the-glu]

My memory is a bit vague, but I remember that it was due to some subcommands of the CLI binary not being yet compatible with the new formats. So it is very likely that this got fixed in the meantime. Have you managed to verify the signature as well? But if both signing and verifying are fine, we can go ahead with the upgrade :)

I did not, but I had to signin with my account and it was complaining like this:

Error: no matching attestations: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value "https://github.com/interuss/monitoring/.github/workflows/image-publish.yml@refs/pull/1406/merge", got "zzz@-.org"
error during command execution: no matching attestations: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value "https://github.com/interuss/monitoring/.github/workflows/image-publish.yml@refs/pull/1406/merge", got "zzz@-.org"

Should it be working? I did assume there was some extra in CI's parameters that I don't have access to, pointing to the correct "account/identity"

[mickmis]

So the issue with the upgrade was that there now seems to be a delay between the time that the signature is published to the registry and the time it is actually exposed. Since we were verifying it immediately after publishing it, the signature could not be found. The new version of cosign uses a new format to bundle the signature so that's probably why the issue appeared now.

In any case, introducing a 30 seconds delay between signing and verifying signature addresses the issue. I've done so in this PR and will merge it.