chore: update cosign from v2 to v3 (#3561)

* chore: update cosign from v2 to v3

Also do not import cosing into zli, as it doubles the bianry size
See: https://github.com/project-zot/zot/actions/runs/19506399474/job/55833719683?pr=3561

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* chore: privileged-test should not depend on downloaded images

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

---------

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

pkg/cli/client/client.go

@@ -17,7 +17,6 @@ import (
 	"time"
 
 	ispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/sigstore/cosign/v2/pkg/oci/remote"
 
 	zerr "zotregistry.dev/zot/v2/errors"
 	"zotregistry.dev/zot/v2/pkg/common"
@@ -520,7 +519,7 @@ func isCosignSigned(ctx context.Context, repo, digestStr string, searchConf Sear
 	username, password string,
 ) bool {
 	var result interface{}
-	cosignTag := strings.Replace(digestStr, ":", "-", 1) + "." + remote.SignatureTagSuffix
+	cosignTag := strings.Replace(digestStr, ":", "-", 1) + "." + common.CosignSignatureTagSuffix
 
 	URL := fmt.Sprintf("%s/v2/%s/manifests/%s", searchConf.ServURL, repo, cosignTag)
 

pkg/cli/client/image_cmd_test.go

@@ -18,9 +18,9 @@ import (
 
 	godigest "github.com/opencontainers/go-digest"
 	ispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
-	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/v3/cmd/cosign/cli/generate"
+	"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/v3/cmd/cosign/cli/sign"
 	. "github.com/smartystreets/goconvey/convey"
 	"gopkg.in/resty.v1"
 

pkg/cli/client/service.go

@@ -588,7 +588,7 @@ func getImage(ctx context.Context, config SearchConfig, username, password, imag
 
 	for _, tag := range tagList.Tags {
 		hasTagPrefix := strings.HasPrefix(tag, "sha256-")
-		hasTagSuffix := strings.HasSuffix(tag, ".sig")
+		hasTagSuffix := strings.HasSuffix(tag, "."+common.CosignSignatureTagSuffix)
 
 		// check if it's an image or a signature
 		// we don't want to show signatures in cli responses