fix(deps): update module github.com/sigstore/cosign/v3 to v3.0.6 (main)

[crossplane-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/sigstore/cosign/v3	v3.0.5 → v3.0.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

sigstore/cosign (github.com/sigstore/cosign/v3)

v3.0.6

Compare Source

Changelog

v3.0.6 resolves GHSA-w6c6-c85g-mmv6. This release also adds support for signing with OpenBao-managed keys.

• f1ad3ee Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#​4801)
• a09afa9 Handle whitespace-only certificate annotation (#​4760)
• 5a38a6d fix(sign): closing SignerVerifier too early when signing with a security key (#​4761)
• 2290a59 Disallow --new-bundle-format and --rfc3161-timestamp (#​4762)
• 36f4008 support managed keys in conformance testing (#​4728)
• 3274cf9 Add support for GCE metadata server env var (#​4732)
• 2e9754a fix: preserve per-layer annotations in WriteAttestationsReferrer (#​4709)
• dece275 Fix parsing of in-toto for string predicates
• bd4f0fd Mark batch of flags for deprecation (#​4698)
• 9b259ff disallow key and cert identity being used together during verification (#​4636)
• 95eb1c3 support key creation in GitLab group (#​4704)

Thanks to all contributors!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[crossplane-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod

Command failed: nix run .#tidy
warning: Git tree '/tmp/renovate/repos/github/crossplane/crossplane-runtime' is dirty
this derivation will be built:
  /nix/store/jnb045kyxsc1pzz55rxsil4w516al708-crossplane-runtime-tidy.drv
error: home directory '/homeless-shelter' exists; please remove it to assure purity of builds without sandboxing

File name: go.mod

Command failed: nix run .#generate
warning: Git tree '/tmp/renovate/repos/github/crossplane/crossplane-runtime' is dirty
these 5 derivations will be built:
  /nix/store/acsd2c3764hxnybhilfnynaxz72s1xbg-buf-1.59.0.drv
  /nix/store/gf51h6ffx5bmbkkbgss0xxzvxhhn614i-controller-tools-0.19.0.drv
  /nix/store/qrm4fcig00pi8pwwbxy0r6am4dgnzhza-protoc-gen-go-grpc-1.5.1.drv
  /nix/store/rrc5b7cm2gcaqkkb14q3gmmpx40ili67-protoc-gen-go-1.36.10.drv
  /nix/store/2267vm4k3frck6bip3blkbw9far97zy7-crossplane-runtime-generate.drv
this path will be fetched (3.23 MiB download, 17.89 MiB unpacked):
  /nix/store/l2mzxnhw99wzb65kg3l0vv815bmzp3a8-protobuf-32.1
error: home directory '/homeless-shelter' exists; please remove it to assure purity of builds without sandboxing