bump to cosign v2.2.3-carbide.3 for new annotation (#322)

* bump cosign to v2.2.3-carbide.3
* use new annotation in 'store info' when listing images

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

---------

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

.goreleaser.yaml

@@ -13,7 +13,7 @@ release:
 
 env:
   - vpkg=hauler.dev/go/hauler/internal/version
-  - cosign_version=v2.2.3+carbide.2
+  - cosign_version=v2.2.3+carbide.3
 
 builds:
   - main: cmd/hauler/main.go

Makefile

@@ -8,7 +8,7 @@ GO_FILES=$(shell go list ./... | grep -v /vendor/)
 GO_COVERPROFILE=coverage.out
 
 # set cosign variables
-COSIGN_VERSION=v2.2.3+carbide.2
+COSIGN_VERSION=v2.2.3+carbide.3
 
 # set build variables
 BIN_DIRECTORY=bin

cmd/hauler/cli/store/info.go

@@ -238,7 +238,11 @@ func newItem(s *store.Layout, desc ocispec.Descriptor, m ocispec.Manifest, plat
 		ctype = "sbom"
 	}
 
-	ref, err := reference.Parse(desc.Annotations[ocispec.AnnotationRefName])
+	refName := desc.Annotations["io.containerd.image.name"]
+	if refName == "" {
+		refName = desc.Annotations[ocispec.AnnotationRefName]
+	}
+	ref, err := reference.Parse(refName)
 	if err != nil {
 		return item{}
 	}