From 3fd92278c340bcd733e0d123a68d273f16ebd344 Mon Sep 17 00:00:00 2001 From: DevITWay | Pavel Volkov Date: Mon, 6 Apr 2026 01:52:55 +0300 Subject: [PATCH] fix: cosign sign-blob use --bundle format (new cosign default) (#103) cosign deprecated --output-signature/--output-certificate in new bundle format, causing open: no such file or directory error. --- .github/workflows/release.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index de5913e..4b15c3a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -267,7 +267,7 @@ jobs: uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v3 - name: Sign binary with cosign (keyless Sigstore) - run: cosign sign-blob --yes --output-signature nora-linux-amd64.sig --output-certificate nora-linux-amd64.pem ./nora-linux-amd64 + run: cosign sign-blob --yes --bundle nora-linux-amd64.bundle ./nora-linux-amd64 - name: Create Release uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 @@ -276,8 +276,7 @@ jobs: files: | nora-linux-amd64 nora-linux-amd64.sha256 - nora-linux-amd64.sig - nora-linux-amd64.pem + nora-linux-amd64.bundle nora-${{ github.ref_name }}.sbom.spdx.json nora-${{ github.ref_name }}.sbom.cdx.json nora-${{ github.ref_name }}.provenance.json