From 3a580f154dcef809eabb219abe28bbabcac2b39c Mon Sep 17 00:00:00 2001
From: Jon Gallant <jong@microsoft.com>
Date: Sat, 18 Jul 2026 12:21:18 -0700
Subject: [PATCH] fix(release): pin cosign to v2.x to keep classic signing

cosign-installer was installing the latest cosign (v3.x), which auto-loads a signing config and forces the single-file bundle format. That broke the classic detached signing (sign-blob --output-signature/--output-certificate) with a chain of errors: first 'cannot specify service URLs and use signing config', then 'must provide --new-bundle-format or --bundle ... with --signing-config'. No release was ever published.

install.sh and install.ps1 verify releases with 'cosign verify-blob --signature <checksums>.sig --certificate <checksums>.pem', so switching to the bundle format would break signature verification for end users. Instead, pin cosign to the maintained v2.x line (v2.6.4, current) which keeps classic behavior, and restore the classic goreleaser signs args.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 524cf702-8922-4cfd-b23f-4069b734e09b
---
 .github/workflows/release.yml |  6 ++++++
 .goreleaser.yml               | 10 +++++-----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 39a3b20..9c1994c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,6 +37,12 @@ jobs:
           go-version-file: go.mod
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          # Pin to the maintained v2.x line. cosign v3 auto-loads a signing
+          # config and forces the new single-file bundle format, which breaks
+          # the classic detached .sig/.pem signing that install.sh and
+          # install.ps1 verify. See the signs block in .goreleaser.yml.
+          cosign-release: v2.6.4
 
       - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
 
diff --git a/.goreleaser.yml b/.goreleaser.yml
index eeae997..61e9567 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -35,16 +35,16 @@ sboms:
   - artifacts: archive
 
 signs:
-  # Keep cosign's classic output (separate .sig + .pem) instead of the new
-  # single-file bundle: install.sh and install.ps1 verify the checksums with
-  # `cosign verify-blob --signature ...sig --certificate ...pem`, which the
-  # bundle format would break.
+  # Classic detached signature: produces ${artifact}.sig and ${artifact}.pem,
+  # which install.sh and install.ps1 verify with
+  # `cosign verify-blob --signature ...sig --certificate ...pem`. cosign is
+  # pinned to the v2.x line in release.yml so this keeps working; cosign v3
+  # forces the single-file bundle format instead.
   - cmd: cosign
     artifacts: checksum
     args:
       - "sign-blob"
       - "--yes"
-      - "--new-bundle-format=false"
       - "--output-signature=${signature}"
       - "--output-certificate=${certificate}"
       - "${artifact}"