update go to 1.22.8 (#3900)

.github/workflows/golangci-lint.yml

@@ -39,7 +39,7 @@ jobs:
  - name: golangci-lint
  uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
  with:
- version: v1.60
+ version: v1.61
  args: --timeout=5m
 
  golangci-test-e2e:
@@ -58,5 +58,5 @@ jobs:
  - name: golangci-lint
  uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
  with:
- version: v1.60
+ version: v1.61
  args: --timeout=5m --build-tags e2e ./test

.github/workflows/validate-release.yml

@@ -26,14 +26,14 @@ jobs:
  check-signature:
  runs-on: ubuntu-latest
  container:
- image: ghcr.io/sigstore/cosign/cosign:v2.4.0-dev@sha256:a97b592b9f73390edcd6ceb5799a62513a906cbdffcdc63f53585910c71b0708
+ image: ghcr.io/sigstore/cosign/cosign:v2.4.1-dev@sha256:a1bb112f1758703aa1d222bf30b9655d04cf196c0b7feaf3479d1222c2283590
 
  steps:
  - name: Check Signature
  run: |
- cosign verify ghcr.io/gythialy/golang-cross:v1.22.7-0@sha256:cb23bfe5773191f1ccc9d60fb73392d5ffc87257e2e019ffe81edb8b352a5284 \
+ cosign verify ghcr.io/gythialy/golang-cross:v1.22.8-0@sha256:569ecf9d1edc0bc8eeb7914946d08e83ec8c50c8d8cfe25bc0cac93775157abd \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
- --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.7-0"
+ --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.8-0"
  env:
  TUF_ROOT: /tmp
 
@@ -43,7 +43,7 @@ jobs:
  - check-signature
 
  container:
- image: ghcr.io/gythialy/golang-cross:v1.22.7-0@sha256:cb23bfe5773191f1ccc9d60fb73392d5ffc87257e2e019ffe81edb8b352a5284
+ image: ghcr.io/gythialy/golang-cross:v1.22.8-0@sha256:569ecf9d1edc0bc8eeb7914946d08e83ec8c50c8d8cfe25bc0cac93775157abd
  volumes:
  - /usr:/host_usr
  - /opt:/host_opt

.golangci.yml

@@ -42,6 +42,9 @@ linters-settings:
  - 'os\.Getenv.*'
  - 'os\.LookupEnv.*'
  exclude-godoc-examples: false
+ gosec:
+ excludes:
+ - G115 # integer overflow conversion int64 -> uint64
 output:
  uniq-by-line: false
 issues:

go.mod

@@ -1,6 +1,6 @@
 module github.com/sigstore/cosign/v2
 
-go 1.22.7
+go 1.22.8
 
 require (
  cuelang.org/go v0.9.2

release/cloudbuild.yaml

@@ -32,20 +32,20 @@ steps:
  echo "Checking out ${_GIT_TAG}"
  git checkout ${_GIT_TAG}
 
- - name: 'ghcr.io/sigstore/cosign/cosign:v2.4.0-dev@sha256:a97b592b9f73390edcd6ceb5799a62513a906cbdffcdc63f53585910c71b0708'
+ - name: 'ghcr.io/sigstore/cosign/cosign:v2.4.1-dev@sha256:a1bb112f1758703aa1d222bf30b9655d04cf196c0b7feaf3479d1222c2283590'
  dir: "go/src/sigstore/cosign"
  env:
  - TUF_ROOT=/tmp
  args:
  - 'verify'
- - 'ghcr.io/gythialy/golang-cross:v1.22.7-0@sha256:cb23bfe5773191f1ccc9d60fb73392d5ffc87257e2e019ffe81edb8b352a5284'
+ - 'ghcr.io/gythialy/golang-cross:v1.22.8-0@sha256:569ecf9d1edc0bc8eeb7914946d08e83ec8c50c8d8cfe25bc0cac93775157abd'
  - '--certificate-oidc-issuer'
  - "https://token.actions.githubusercontent.com"
  - '--certificate-identity'
  - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.7-0"
 
  # maybe we can build our own image and use that to be more in a safe side
- - name: ghcr.io/gythialy/golang-cross:v1.22.7-0@sha256:cb23bfe5773191f1ccc9d60fb73392d5ffc87257e2e019ffe81edb8b352a5284
+ - name: ghcr.io/gythialy/golang-cross:v1.22.8-0@sha256:569ecf9d1edc0bc8eeb7914946d08e83ec8c50c8d8cfe25bc0cac93775157abd
  entrypoint: /bin/sh
  dir: "go/src/sigstore/cosign"
  env:
@@ -68,7 +68,7 @@ steps:
  gcloud auth configure-docker \
  && make release
 
- - name: ghcr.io/gythialy/golang-cross:v1.22.7-0@sha256:cb23bfe5773191f1ccc9d60fb73392d5ffc87257e2e019ffe81edb8b352a5284
+ - name: ghcr.io/gythialy/golang-cross:v1.22.8-0@sha256:569ecf9d1edc0bc8eeb7914946d08e83ec8c50c8d8cfe25bc0cac93775157abd
  entrypoint: 'bash'
  dir: "go/src/sigstore/cosign"
  env: