Add support for recording creation timestamp for cosign attest

[zshorvath]

Summary

• cosign 2.2.0 deleted automatic, non-deterministic recording of the creation timestamp in the config layer of signatures, attestations, sboms
• cosign 2.2.4 introduced --record-creation-timestamp, but only enabled it for cosign sign, leaving the timestamp empty for attestations. It is a huge problem for oci registries allowing automatic cleanup policies as they won't be able to tell the creation time. GitLab for example is reporting 23 years of age for uploaded attestations

Release Note

• Enables --record-creation-timestamp flag for cosign attest

Documentation

attach an attestation to a container image and honor the creation timestamp of the signature

cosign attest --predicate <FILE> --type <TYPE> --key cosign.key --record-creation-timestamp <IMAGE>

References

• Artifacts are non-deterministic #3120
• OCI manifest created timestamp wrong with v2.2.0 #3298

[haydentherapper]

Thanks!
fyi @jonjohnsonjr

[codecov]

Codecov Report

Attention: Patch coverage is 23.80952% with 16 lines in your changes missing coverage. Please review.

Project coverage is 37.67%. Comparing base (2ef6022) to head (07fb281).
Report is 169 commits behind head on main.

Files	Patch %	Lines
cmd/cosign/cli/attest.go	29.41%	12 Missing ⚠️
cmd/cosign/cli/options/attest.go	0.00%	3 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3797      +/-   ##
==========================================
- Coverage   40.10%   37.67%   -2.44%     
==========================================
  Files         155      201      +46     
  Lines       10044    12444    +2400     
==========================================
+ Hits         4028     4688     +660     
- Misses       5530     7180    +1650     
- Partials      486      576      +90     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[haydentherapper]

can you rerun make docgen?

[zshorvath]

make docgen

I have made a change so attest.go and cosign_attest.md has the same example line at the top, after this ./cmd/help/verify.sh should complete without an error