From db16707b7ecb8618c3e6b98187d0de1b4459b926 Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Mon, 27 Jul 2026 12:38:51 +0100
Subject: [PATCH] Use cosign --bundle for checksum signing

The previous --output-certificate/--output-signature flags are ignored
under cosign's new default bundle format, causing sign-blob to fail with
'create bundle file: open : no such file or directory'. Match the config
used in the other git-pkgs binaries.
---
 .goreleaser.yaml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 70841a0..6f7e1cf 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -35,11 +35,10 @@ checksum:
 
 signs:
   - cmd: cosign
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.cosign.bundle"
     args:
       - sign-blob
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}"
       - "${artifact}"
       - "--yes"
     artifacts: checksum