ggcr: 'go test -race' fails on github.com/sigstore/cosign commit 38e2b30b270128998cf7fc819ffa08fca41cda7e

[dmitris]

Describe the bug

Our internal CI builds of a copy of the gitgub.com/sigstore/cosign copy commit 38e2b30 intermittently fail in go test -race ./... step, using go1.21.4. Copy of the race test output: https://gist.github.com/dmitris/eb23914daa0a06924334d077427691b9 (search for "WARNING: DATA RACE").

To Reproduce

Reproduction is difficult - I cannot recreate it on a Mac or on a RHEL8 VM. Even in our CI, the builds sometimes succeed, sometimes fail.

Expected behavior

go test -race ./... completes with no error consistently.

Additional context

github.com/sigstore/cosign uses the latest version v0.16.1 of the github.com/google/go-containerregistry dependency:
https://github.com/sigstore/cosign/blob/38e2b30b270128998cf7fc819ffa08fca41cda7e/go.mod#L20,
same in the latest version: https://github.com/sigstore/cosign/blob/main/go.mod#L20

[dmitris]

this should be fixed with #1806 - looking forward to it being merged! 😄

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.