bump cosign to v1.9.0 to resolve reporting of GHSA-66x3-6cw3-v5gj (#1025)

Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>

cmd/syft/cli/attest.go

@@ -8,9 +8,10 @@ import (
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+
+	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 )
 
 const (
@@ -55,7 +56,7 @@ func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions) *c
 			}
 
 			// build cosign key options for attestation
-			ko := sign.KeyOpts{
+			ko := sigopts.KeyOpts{
 				KeyRef:                   app.Attest.KeyRef,
 				FulcioURL:                app.Attest.FulcioURL,
 				IDToken:                  app.Attest.FulcioIdentityToken,

cmd/syft/cli/attest/attest.go

@@ -29,6 +29,7 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/pkg/errors"
+	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
 	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
 	"github.com/sigstore/cosign/pkg/cosign"
@@ -57,7 +58,7 @@ var (
 	intotoJSONDsseType = `application/vnd.in-toto+json`
 )
 
-func Run(ctx context.Context, app *config.Application, ko sign.KeyOpts, args []string) error {
+func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args []string) error {
 	// We cannot generate an attestation for more than one output
 	if len(app.Outputs) > 1 {
 		return fmt.Errorf("unable to generate attestation for more than one output")