Bump knative/pkg and cosign dependencies

[imjasonh]

Bumps to knative/pkg @ release-1.6 and cosign@latest (1.10.1)

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• [ ] Has Docs included if any changes are user facing
• [ ] Has Tests included if any functionality added or changed
• [x] Follows the commit message standard
• [x] Meets the Tekton contributor standards (including functionality, content, code)
• [x] Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• [x] Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: To complete the pull request process, please assign priyawadhwa after the PR has been reviewed. You can assign the PR to them by writing /assign @priyawadhwa in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[wlynch]

This is running into the same problem as https://github.com/tektoncd/chains/pull/514 😭

We need Go 1.18 but the CI images are on 1.17. I made a PR to bump it, but it was causing issues with other tekton projects - https://tektoncd.slack.com/archives/CJ4ERJWAU/p1660211899070299

[imjasonh]

This is running into the same problem as #514 😭

We need Go 1.18 but the CI images are on 1.17. I made a PR to bump it, but it was causing issues with other tekton projects - https://tektoncd.slack.com/archives/CJ4ERJWAU/p1660211899070299

Yeah, sounds like there's some ongoing work @abayer is doing to get us up onto 1.18. I'm going to stop pushing these things for now until these land.

[imjasonh]

--- FAIL: TestNoDeps (0.59s)
    --- FAIL: TestNoDeps/github.com/tektoncd/chains/cmd/controller (0.59s)
        depcheck.go:126: CheckNoDependency() = github.com/tektoncd/chains/cmd/controller depends on banned dependency github.com/golang/glog
            github.com/tektoncd/chains/cmd/controller
            github.com/tektoncd/chains/pkg/reconciler/taskrun
            github.com/tektoncd/chains/pkg/chains
            github.com/tektoncd/chains/pkg/chains/signing/x509
            github.com/sigstore/cosign/cmd/cosign/cli/fulcio  # Also: [github.com/sigstore/cosign/cmd/cosign/cli/options github.com/sigstore/cosign/pkg/cosign/git github.com/sigstore/cosign/pkg/cosign/git/github github.com/sigstore/cosign/pkg/cosign/git/gitlab github.com/sigstore/cosign/pkg/cosign/kubernetes github.com/sigstore/cosign/pkg/signature github.com/tektoncd/chains/pkg/chains github.com/tektoncd/chains/pkg/chains/signing/x509]
            github.com/sigstore/cosign/pkg/cosign
            github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl
            github.com/google/certificate-transparency-go/x509util
            github.com/golang/glog
FAIL
FAIL	github.com/tektoncd/chains/cmd/controller	1.094s
FAIL

😭

[tekton-robot]

@imjasonh: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-tekton-chains-unit-tests	99fd62977a549fa1ce826ba6bd23534ac95420ce	link	true	/test pull-tekton-chains-unit-tests
pull-tekton-chains-integration-tests	99fd62977a549fa1ce826ba6bd23534ac95420ce	link	true	/test pull-tekton-chains-integration-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[tekton-robot]

@imjasonh: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[wlynch]

Closing this in favor of https://github.com/tektoncd/chains/pull/514

If there are more bumps you want to do, feel free to open another PR!