chore(deps): update dependency sigstore/cosign to v1.13.6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
sigstore/cosign	uses-with	minor	v1.12.1 → v1.13.6

---

Release Notes

sigstore/cosign (sigstore/cosign)

v1.13.6

Compare Source

Note: v1.13.3, .4, and .5 were skipped due to issues in the release pipeline

This release backports support for the latest TUF specification. We encourage users to upgrade to Cosign v2.

Updates

• V1 go tuf update (#​3598)
• Update cloud build script to latest for v1.13.x (#​3615)

v1.13.2

Compare Source

This release backports a security fix. We encourage users to upgrade to Cosign v2.

Updates

• [release-1.13] update builder image that uses go 1.19.4 (#​2521)
• Backport GHSA-vfp6-jrw2-99g9 in (#​3364)

v1.13.1

Compare Source

Enhancements

• verify-blob-attestation: allow multiple subjects in in_toto attestation (#​2341)
• Add verify-blob-attestation command and tests (#​2337)
• Add --output-attestation flag to attest-blob and remove experimental signing (#​2332)
• Add attest-blob command (#​2286)
• Add '--cert-identity' flag to support subject alternate names for ver… (#​2278)
• Update Dockerfile section of README (#​2323)

Bug Fixes

• Update warning when users sign images by tag. (#​2313)

Others

• Remove experimental flags from attest-blob and refactor (#​2338)

Contributors

• Alex Cameron
• Ville Aikas
• Zack Newman
• asraa
• kpk47
• priyawadhwa

v1.13.0

Compare Source

Highlights

• For users who have deployed a private instance of Fulcio release v0.6.x and issue certificates with the Username identity, you will need to upgrade to use this version."

Enhancements

• Add support for Fulcio username identity in SAN (#​2291)
• Data race in FetchSignaturesForReference (#​2283)
• Check error on chain verification failure (#​2284)
• feat: improve the verification message (#​2268)
• feat: use stdin as an input for predicate (#​2269)

Bug Fixes

• fix: make tlog entry lookups for online verification shard-aware (#​2297)
• Fix: Create a static copy of signatures as part of verification. (#​2287)
• Fix: Remove an extra registry request from verification path. (#​2285)
• fix pivtool generate key touch policy (#​2282)

Others

• use scaffolding 0.4.8 for tests. (#​2280)

Contributors

• Asra Ali (@​asraa)
• Batuhan Apaydın (@​developer-guy)
• Carlos Tadeu Panato Junior (@​cpanato)
• Hayden Blauzvern (@​haydentherapper)
• Matt Moore (@​mattmoor)
• Ross Tannenbaum (@​RTann)
• Ville Aikas (@​vaikas)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 5am on thursday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.