From 3680a92d84cad0350608cdc14fce518360ef27fc Mon Sep 17 00:00:00 2001
From: Andrey Lesnikov <52860508+justrunme@users.noreply.github.com>
Date: Sun, 11 Oct 2026 17:50:33 +0200
Subject: [PATCH 1/2] fix(release): restore checksum sign-blob args for pinned
 cosign

---
 .goreleaser.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 63c2c4f..95890ff 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -62,11 +62,10 @@ signs:
     signature: '${artifact}.sig'
     args:
       - sign-blob
-      - '--yes'
-      - '--new-bundle-format=false'
       - '--output-certificate=${certificate}'
       - '--output-signature=${signature}'
       - '${artifact}'
+      - '--yes'
     artifacts: checksum
     output: true
 

From 662c95ef2ead49d16e55b3f196fbf795ef845368 Mon Sep 17 00:00:00 2001
From: Andrey Lesnikov <52860508+justrunme@users.noreply.github.com>
Date: Sun, 11 Oct 2026 17:50:34 +0200
Subject: [PATCH 2/2] fix(release): pin cosign to v2.5.2 for goreleaser
 checksum signing

---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b9c342..5cdfe1a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,6 +25,8 @@ jobs:
       
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v2.5.2
       
       - name: Install syft
         run: |