Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.5.3

[dependabot]

Bumps github.com/sigstore/cosign/v2 from 2.5.2 to 2.5.3.

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.5.3

Changelog

• 488ef8ceed5ab5d77379e9077a124a0d0df41d06 Add signing-config create command (#4280)
• 722207e0059efea600a7c03ea4ff6caa889d84d3 Allow multiple services to be specified for trusted-root create (#4285)
• 2ee22fcdf520a984281ff0195be89810a952280c force when copying the latest image to overwrite (#4298)
• 86560e15eb407f7fa2ddddc7d9dbc4ba33cff635 Fix cert verification logic for trusted-root/SCTs (#4294)
• 9f3b013feb3d46c8ee6d5539e7b13eb736ba14ce Fix lint error for types package (#4295)
• 3b3c0fc20b621ed148b3efea00204f67bfda039d feat: Add OCI 1.1+ experimental support to tree (#4205)
• 49c8d784a78d298d0eef1f9898d70eb2d0f07536 Add validity period end for trusted-root create (#4271)
• ba8214ec0c6e50ef8c4e4272a16ccfacf5f3147d avoid double-loading trustedroot from file (#4264)

Thanks to all contributors!

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.5.3

Features

• Add signing-config create command (#4280)
• Allow multiple services to be specified for trusted-root create (#4285)
• feat: Add OCI 1.1+ experimental support to tree (#4205)
• Add validity period end for trusted-root create (#4271)

Bug Fixes

• Fix cert verification logic for trusted-root/SCTs (#4294)
• force when copying the latest image to overwrite (#4298)
• avoid double-loading trustedroot from file (#4264)

Commits

• 488ef8c Add signing-config create command (#4280)
• 722207e Allow multiple services to be specified for trusted-root create (#4285)
• e31d70b bump go-github to v73 (#4297)
• 2ee22fc force when copying the latest image to overwrite (#4298)
• 86560e1 Fix cert verification logic for trusted-root/SCTs (#4294)
• 9f3b013 Fix lint error for types package (#4295)
• 34f0ff9 chore(deps): bump github.com/buildkite/agent/v3 from 3.101.0 to 3.102.1 (#4288)
• b2b9462 chore(deps): bump github.com/sigstore/protobuf-specs from 0.4.3 to 0.5.0 (#4289)
• 60d47a0 chore(deps): bump google.golang.org/api from 0.240.0 to 0.241.0 (#4291)
• 5dac117 chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 (#4293)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[tekton-robot]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign puneetpunamiya after the PR has been reviewed.
You can assign the PR to them by writing /assign @puneetpunamiya in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tekton-robot]

@dependabot: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[anithapriyanatarajan]

@dependabot rebase

[dependabot]

Sorry, only users with push access can use that command.

[dependabot]

Superseded by #2910.