From 43326f8f167e96bfeb138b33007a46df3f633a47 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Sun, 25 Oct 2026 09:44:04 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20release:=20sign=20checksums=20as?=
 =?UTF-8?q?=20a=20cosign=20v3=20sigstore=20bundle?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cosign-installer v4.1.2 installs cosign 3.x, where sign-blob writes a
bundle and the separate --output-certificate/--output-signature flags
fail with 'create bundle file: open : no such file or directory'
(release run 40198699489 for v0.1.0).

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 .goreleaser.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 4b91276..4905dd6 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -37,12 +37,13 @@ checksum:
 
 signs:
   - cmd: cosign
-    certificate: "${artifact}.pem"
+    # cosign v3 writes one sigstore bundle (certificate + signature + log entry).
+    # Verify: cosign verify-blob --bundle checksums.txt.sigstore.json checksums.txt
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - --yes
-      - --output-certificate=${certificate}
-      - --output-signature=${signature}
+      - --bundle=${signature}
       - ${artifact}
     artifacts: checksum
     output: true