From ad45dfbbe4b846f9354a17d9eb4bb4aa6399b15e Mon Sep 17 00:00:00 2001
From: Andrey Lesnikov <52860508+justrunme@users.noreply.github.com>
Date: Sun, 11 Oct 2026 17:56:37 +0200
Subject: [PATCH] fix(release): sign checksums with cosign --bundle

Current cosign requires --bundle / new-bundle-format for sign-blob; write a
sigstore JSON bundle instead of deprecated --output-signature paths.
---
 .goreleaser.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 95890ff..83f4da8 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -58,17 +58,16 @@ signs:
   - cmd: cosign
     env:
       - COSIGN_EXPERIMENTAL=1
-    certificate: '${artifact}.pem'
-    signature: '${artifact}.sig'
+    signature: '${artifact}.sigstore.json'
     args:
       - sign-blob
-      - '--output-certificate=${certificate}'
-      - '--output-signature=${signature}'
-      - '${artifact}'
       - '--yes'
+      - '--bundle=${signature}'
+      - '${artifact}'
     artifacts: checksum
     output: true
 
+
 dockers:
   - image_templates:
       - "ghcr.io/justrunme/blastguard:{{ .Tag }}-amd64"