build(deps): migrate protovalidate to v1.1.0 and upgrade cosign to v3 (#2618)

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Miguel Martinez <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: migmartri

app/artifact-cas/api/buf.gen.yaml

@@ -1,15 +1,14 @@
-version: v1
+version: v2
 plugins:
-  - name: go
+  - local: protoc-gen-go
     out: .
     opt: paths=source_relative
-  - name: go-errors
+  - local: protoc-gen-go-errors
     out: .
     opt: paths=source_relative
-  - name: go-grpc
+  - local: protoc-gen-go-grpc
     out: .
-    opt:
-      - paths=source_relative
-  - name: go-http
+    opt: paths=source_relative
+  - local: protoc-gen-go-http
     out: .
     opt: paths=source_relative

app/artifact-cas/api/buf.lock

@@ -20,7 +20,7 @@ import (
 	"os"
 	"time"
 
-	"github.com/bufbuild/protovalidate-go"
+	"buf.build/go/protovalidate"
 	"github.com/getsentry/sentry-go"
 
 	"github.com/chainloop-dev/chainloop/app/artifact-cas/internal/conf"
@@ -145,7 +145,7 @@ func main() {
 	}
 }
 
-func newProtoValidator() (*protovalidate.Validator, error) {
+func newProtoValidator() (protovalidate.Validator, error) {
 	return protovalidate.New()
 }
 

app/artifact-cas/api/buf.yaml

@@ -1,5 +1,5 @@
-version: v1
+version: v2
 plugins:
-  - name: go
+  - local: protoc-gen-go
     out: .
     opt: paths=source_relative

app/artifact-cas/cmd/main.go

@@ -35,7 +35,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"google.golang.org/genproto/googleapis/bytestream"
 
-	"github.com/bufbuild/protovalidate-go"
+	"buf.build/go/protovalidate"
 	"github.com/go-kratos/kratos/v2/log"
 	"github.com/go-kratos/kratos/v2/middleware/logging"
 	"github.com/go-kratos/kratos/v2/middleware/recovery"
@@ -49,7 +49,7 @@ import (
 )
 
 // NewGRPCServer new a gRPC server.
-func NewGRPCServer(c *conf.Server, authConf *conf.Auth, byteService *service.ByteStreamService, rSvc *service.ResourceService, providers backend.Providers, validator *protovalidate.Validator, logger log.Logger) (*grpc.Server, error) {
+func NewGRPCServer(c *conf.Server, authConf *conf.Auth, byteService *service.ByteStreamService, rSvc *service.ResourceService, providers backend.Providers, validator protovalidate.Validator, logger log.Logger) (*grpc.Server, error) {
 	log := log.NewHelper(logger)
 	// Load the key on initialization instead of on every request
 	// TODO: implement jwks endpoint

app/artifact-cas/internal/conf/buf.gen.yaml

@@ -22,7 +22,7 @@ import (
 
 	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/verifier"
-	"github.com/sigstore/cosign/v2/pkg/blob"
+	"github.com/sigstore/cosign/v3/pkg/blob"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )

app/artifact-cas/internal/conf/buf.lock

@@ -29,9 +29,9 @@ import (
 	"github.com/chainloop-dev/chainloop/pkg/attestation/verifier"
 	intoto "github.com/in-toto/attestation/go/v1"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/v2/pkg/blob"
-	"github.com/sigstore/cosign/v2/pkg/cosign"
-	sigs "github.com/sigstore/cosign/v2/pkg/signature"
+	"github.com/sigstore/cosign/v3/pkg/blob"
+	"github.com/sigstore/cosign/v3/pkg/cosign"
+	sigs "github.com/sigstore/cosign/v3/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 	sigdsee "github.com/sigstore/sigstore/pkg/signature/dsse"