Use cosign bundle for release checksum signing#169
Conversation
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Switches release checksum signing from separate cosign signature/certificate outputs to a single keyless cosign bundle artifact, and updates release documentation to reflect the bundle-based flow.
Changes:
- Update GoReleaser checksum signing to emit a
.bundlefile viacosign sign-blob --bundle .... - Adjust signing output naming so the generated bundle is uploaded as a release artifact.
- Refresh release docs to describe checksum signing as a keyless cosign bundle (OIDC).
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
RELEASING.md |
Updates the release workflow step description to reflect bundle-based checksum signing. |
.goreleaser.yaml |
Switches checksum signing to produce a .bundle output using cosign’s bundle flags. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
Validation
Summary by cubic
Switch release checksum signing to a
cosignkeyless bundle to improve verification and portability.goreleasernow emits a single.bundleper checksum and docs reflect the new flow.cosign verify-blob --bundle <checksum-file>.bundle <checksum-file>..bundlefiles instead of separate signature/certificate outputs.Written for commit 31210e0. Summary will update on new commits.