From 8a4f7f4b616282f7a5088ccf5e531328472dac83 Mon Sep 17 00:00:00 2001
From: mayankpande88 <mayankpande88@gmail.com>
Date: Mon, 27 Jul 2026 21:10:49 +0530
Subject: [PATCH] fix(ci): sign release checksums with cosign --bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cosign-installer v4 ships cosign v3, which defaults to the new bundle
format: --output-signature and --output-certificate are ignored, and a
single --bundle file carries the signature, Fulcio certificate and
transparency-log entry together. With neither flag honoured and no
--bundle given, cosign tries to create a bundle at an empty path and
fails with:

  Error: signing checksums.txt: create bundle file: open : no such file
  or directory

This broke the github-release job of the v0.1.3 release — the image,
chart, binaries, SBOM and ECR mirrors all published, but no GitHub
Release or signed checksums were produced. It would break every release
from here on, not just that one.

Switch to --bundle checksums.txt.bundle. The release upload already
globs dist/*, so the bundle ships without further change. Verification
instructions are recorded inline, and the CHANGELOG entry advertising
the .sig/.pem pair is corrected to match what actually ships.
---
 .github/workflows/release.yml | 23 +++++++++++++++++------
 CHANGELOG.md                  |  2 +-
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 385b66e..24eb154 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -287,13 +287,24 @@ jobs:
         working-directory: dist
         run: |
           # One checksum manifest over every release asset, then a keyless
-          # cosign signature + certificate over that manifest. Verifiers
-          # check the signature once and the checksums cover the rest.
+          # cosign signature over that manifest. Verifiers check the signature
+          # once and the checksums cover the rest.
+          #
+          # cosign v3 (shipped by cosign-installer v4) defaults to the new
+          # bundle format: --output-signature / --output-certificate are ignored
+          # and a single --bundle file carries the signature, the Fulcio
+          # certificate and the transparency-log entry together. Without
+          # --bundle it fails with "create bundle file: open : no such file or
+          # directory", which broke the v0.1.3 release.
+          #
+          # Verify a downloaded release with:
+          #   cosign verify-blob --bundle checksums.txt.bundle \
+          #     --certificate-identity-regexp '^https://github.com/nudgebee/forager/' \
+          #     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+          #     checksums.txt
+          #   sha256sum -c checksums.txt
           sha256sum * > checksums.txt
-          cosign sign-blob --yes \
-            --output-signature checksums.txt.sig \
-            --output-certificate checksums.txt.pem \
-            checksums.txt
+          cosign sign-blob --yes --bundle checksums.txt.bundle checksums.txt
 
       - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ccebba1..d355b1e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - CodeQL static analysis workflow (`codeql.yml`) for Go.
 - `govulncheck` job in CI to flag known vulnerabilities in dependencies.
 - Release artifacts now ship a `checksums.txt` with a keyless cosign
-  signature (`checksums.txt.sig` / `.pem`) so downloads can be verified.
+  signature (`checksums.txt.bundle`) so downloads can be verified.
 - Native Go fuzz tests for the signing package: public-key parsing,
   canonical-JSON normalization, and signature envelope verification.