Fix piping 'cosign verify' using fulcio/rekor

[marcofranssen]

Summary

Piping cosign verify with experimental mode is broken in v1.6.0.

$ COSIGN_EXPERIMENTAL=1 cosign verify-attestation ghcr.io/marcofranssen/slsa-workflow-examples-docker@sha256:44aeae57e33b680de437fb49a350adf157aeb5d5b5f4dcbb1103053bd9b415df | jq '.payload |= @base64d | .payload | fromjson | select(.predicateType == "https://spdx.dev/Document") | .predicate.Data | fromjson'

Verification for ghcr.io/marcofranssen/slsa-workflow-examples-docker@sha256:44aeae57e33b680de437fb49a350adf157aeb5d5b5f4dcbb1103053bd9b415df --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - Any certificates were verified against the Fulcio roots.
parse error: Invalid numeric literal at line 1, column 12

Release Note

Fixes piping `cosign verify` to other commands in shell when using experimental mode

[codecov-commenter]

Codecov Report

Merging #1590 (944725c) into main (0cdde4a) will not change coverage.
The diff coverage is 0.00%.

@@           Coverage Diff           @@
##             main    #1590   +/-   ##
=======================================
  Coverage   27.46%   27.46%           
=======================================
  Files         137      137           
  Lines        7741     7741           
=======================================
  Hits         2126     2126           
  Misses       5386     5386           
  Partials      229      229           

Impacted Files	Coverage Δ
cmd/cosign/cli/verify/verify.go	0.00% <0.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0cdde4a...944725c. Read the comment docs.