Bump sigstore-go to v0.3.0 and add local registry for tests (#3154)

* Bump sigstore-go to v0.3.0

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@stacklok.com>

* Create local constant of old bundle mimetype

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@stacklok.com>

* go mod tidy

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@stacklok.com>

* Add container bundle test and fixtures

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@stacklok.com>

* Spin up registry before launching unit tests

This commit adds a step to the tests workflow to spin up a
new registry before running all th tests.

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@stacklok.com>

---------

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@stacklok.com>

.github/workflows/test.yml

@@ -1,5 +1,6 @@
 on:
  workflow_call:
+ workflow_dispatch:
 jobs:
  test:
  name: Unit testing
@@ -23,8 +24,16 @@ jobs:
  # copy config file into place
  - name: Copy config file
  run: cp config/server-config.yaml.example ./server-config.yaml
+ - name: Launch Registry
+ run: |
+ if [ "$(docker inspect -f '{{.State.Running}}' registry 2>/dev/null || true)" != 'true' ]; then
+ docker run -d --restart=always -p "127.0.0.1:5000:5000" --network bridge --name registry \
+ registry:2
+ fi
  # Run the tests
  - name: Run tests
+ env:
+ MINDER_TEST_REGISTRY: "localhost:5000"
  run: make test-silent
  cover:
  name: Coverage

go.mod

@@ -44,7 +44,7 @@ require (
  github.com/signalfx/splunk-otel-go/instrumentation/database/sql/splunksql v1.15.0
  github.com/signalfx/splunk-otel-go/instrumentation/github.com/lib/pq/splunkpq v1.15.0
  github.com/sigstore/protobuf-specs v0.3.1
- github.com/sigstore/sigstore-go v0.2.0
+ github.com/sigstore/sigstore-go v0.3.0
  github.com/spf13/cobra v1.8.0
  github.com/spf13/pflag v1.0.5
  github.com/spf13/viper v1.18.2
@@ -74,10 +74,10 @@ require (
  gopkg.in/yaml.v3 v3.0.1
  k8s.io/apimachinery v0.30.0
  k8s.io/client-go v0.30.0
+ sigs.k8s.io/release-utils v0.7.7
 )
 
 require (
- cloud.google.com/go/kms v1.15.7 // indirect
  filippo.io/edwards25519 v1.1.0 // indirect
  github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
  github.com/Masterminds/squirrel v1.5.4 // indirect
@@ -149,13 +149,13 @@ require (
  github.com/shirou/gopsutil/v3 v3.23.12 // indirect
  github.com/shoenig/go-m1cpu v0.1.6 // indirect
  github.com/signalfx/splunk-otel-go/instrumentation/internal v1.15.0 // indirect
- github.com/sigstore/sigstore v1.8.1 // indirect
+ github.com/sigstore/sigstore v1.8.3 // indirect
  github.com/sourcegraph/conc v0.3.0 // indirect
  github.com/stoewer/go-strcase v1.3.0 // indirect
  github.com/testcontainers/testcontainers-go v0.30.0 // indirect
  github.com/testcontainers/testcontainers-go/modules/mysql v0.30.0 // indirect
  github.com/testcontainers/testcontainers-go/modules/postgres v0.30.0 // indirect
- github.com/theupdateframework/go-tuf/v2 v2.0.0-20240207172116-f5cf71290141 // indirect
+ github.com/theupdateframework/go-tuf/v2 v2.0.0-20240223092044-1e7978e83f63 // indirect
  github.com/tklauser/go-sysconf v0.3.12 // indirect
  github.com/tklauser/numcpus v0.6.1 // indirect
  github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
@@ -169,7 +169,7 @@ require (
 )
 
 require (
- cloud.google.com/go/compute v1.24.0 // indirect
+ cloud.google.com/go/compute v1.25.0 // indirect
  cloud.google.com/go/compute/metadata v0.2.3 // indirect
  dario.cat/mergo v1.0.0
  github.com/Microsoft/go-winio v0.6.1 // indirect
@@ -201,21 +201,21 @@ require (
  github.com/go-ini/ini v1.67.0 // indirect
  github.com/go-logr/logr v1.4.1 // indirect
  github.com/go-logr/stdr v1.2.2 // indirect
- github.com/go-openapi/analysis v0.22.0 // indirect
- github.com/go-openapi/errors v0.21.0 // indirect
- github.com/go-openapi/jsonpointer v0.20.2 // indirect
- github.com/go-openapi/jsonreference v0.20.4 // indirect
- github.com/go-openapi/loads v0.21.5 // indirect
- github.com/go-openapi/runtime v0.27.1 // indirect
- github.com/go-openapi/spec v0.20.14 // indirect
- github.com/go-openapi/strfmt v0.22.0 // indirect
- github.com/go-openapi/swag v0.22.9 // indirect
- github.com/go-openapi/validate v0.22.6 // indirect
+ github.com/go-openapi/analysis v0.23.0 // indirect
+ github.com/go-openapi/errors v0.22.0 // indirect
+ github.com/go-openapi/jsonpointer v0.21.0 // indirect
+ github.com/go-openapi/jsonreference v0.21.0 // indirect
+ github.com/go-openapi/loads v0.22.0 // indirect
+ github.com/go-openapi/runtime v0.28.0 // indirect
+ github.com/go-openapi/spec v0.21.0 // indirect
+ github.com/go-openapi/strfmt v0.23.0 // indirect
+ github.com/go-openapi/swag v0.23.0 // indirect
+ github.com/go-openapi/validate v0.24.0 // indirect
  github.com/go-playground/locales v0.14.1 // indirect
  github.com/go-playground/universal-translator v0.18.1 // indirect
  github.com/gobwas/glob v0.2.3 // indirect
  github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
- github.com/google/certificate-transparency-go v1.1.7 // indirect
+ github.com/google/certificate-transparency-go v1.1.8 // indirect
  github.com/google/go-querystring v1.1.0 // indirect
  github.com/gorilla/mux v1.8.1 // indirect
  github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -263,8 +263,8 @@ require (
  github.com/sassoftware/relic v7.2.1+incompatible // indirect
  github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
  github.com/shibumi/go-pathspec v1.3.0 // indirect
- github.com/sigstore/rekor v1.3.5 // indirect
- github.com/sigstore/timestamp-authority v1.2.1 // indirect
+ github.com/sigstore/rekor v1.3.6 // indirect
+ github.com/sigstore/timestamp-authority v1.2.2 // indirect
  github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
  github.com/skeema/knownhosts v1.2.2 // indirect
  github.com/sony/gobreaker v0.5.0 // indirect
@@ -282,7 +282,7 @@ require (
  github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
  github.com/yashtewari/glob-intersection v0.2.0 // indirect
  github.com/zitadel/oidc/v2 v2.12.0
- go.mongodb.org/mongo-driver v1.13.1 // indirect
+ go.mongodb.org/mongo-driver v1.14.0 // indirect
  go.opentelemetry.io/otel/metric v1.25.0
  go.uber.org/atomic v1.11.0 // indirect
  go.uber.org/multierr v1.11.0 // indirect