Upgrade to newest sigstore-java (#162)

- Remove jarsign goal, we don't want to support that
- Use new .sigstore.json bundle extension

Signed-off-by: Appu Goundan <appu@google.com>

pom.xml

@@ -90,14 +90,14 @@
       <dependency>
         <groupId>dev.sigstore</groupId>
         <artifactId>sigstore-java</artifactId>
-        <version>0.5.0</version>
+        <version>0.10.0</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
       <dependency>
         <groupId>dev.sigstore</groupId>
         <artifactId>sigstore-java</artifactId>
-        <version>0.5.0</version>
+        <version>0.10.0</version>
       </dependency>
     </dependencies>
   </dependencyManagement>

src/it/jarsign/verify.groovy

@@ -12,6 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-File cert = new File( basedir, "target/signingCert.pem" );
+File cert = new File( basedir, "target/simple-it-1.0-SNAPSHOT.jar.sigstore.json" );
 
 assert cert.isFile()