From 07d205ca413335f2bd3669604f7e9fdb6dc9afc0 Mon Sep 17 00:00:00 2001
From: Jon Gallant <jong@microsoft.com>
Date: Sat, 18 Jul 2026 11:52:12 -0700
Subject: [PATCH] fix(release): keep cosign classic signature format

After removing --oidc-issuer, cosign got further but failed with 'create bundle file: open : no such file or directory': the newer cosign defaults to --new-bundle-format, which ignores --output-signature/--output-certificate and needs a --bundle path. Rather than switch to a single .bundle (which would break the signature verification in install.sh and install.ps1 that download separate .sig and .pem files), disable the new bundle format so the classic .sig/.pem artifacts are produced as before.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 524cf702-8922-4cfd-b23f-4069b734e09b
---
 .goreleaser.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 70ac099..eeae997 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -35,11 +35,16 @@ sboms:
   - artifacts: archive
 
 signs:
+  # Keep cosign's classic output (separate .sig + .pem) instead of the new
+  # single-file bundle: install.sh and install.ps1 verify the checksums with
+  # `cosign verify-blob --signature ...sig --certificate ...pem`, which the
+  # bundle format would break.
   - cmd: cosign
     artifacts: checksum
     args:
       - "sign-blob"
       - "--yes"
+      - "--new-bundle-format=false"
       - "--output-signature=${signature}"
       - "--output-certificate=${certificate}"
       - "${artifact}"