fix(cosign): update signing workflow (openbao#2103)

* fix(cosign): update signing workflow

Signed-off-by: Pascal Reeb <pascal.reeb@secretz.io>

* fix(cosign): remove oidc issuer

Signed-off-by: Pascal Reeb <pascal.reeb@secretz.io>

---------

Signed-off-by: Pascal Reeb <pascal.reeb@secretz.io>

Author: pree

goreleaser.hsm.yaml

@@ -424,12 +424,10 @@ signs:
   - id: cosign
     artifacts: all
     cmd: cosign
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sigstore.json"
     args:
       - "sign-blob"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}" # needed on cosign 3.0.0+
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
   - id: gpg
@@ -448,7 +446,6 @@ docker_signs:
   - artifacts: all
     args:
       - "sign"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "${artifact}@${digest}"
       - "--yes" # needed on cosign 2.0.0+
 

goreleaser.linux.yaml

@@ -693,12 +693,10 @@ signs:
   - id: cosign
     artifacts: all
     cmd: cosign
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sigstore.json"
     args:
       - "sign-blob"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}" # needed on cosign 3.0.0+
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
   - id: gpg
@@ -717,7 +715,6 @@ docker_signs:
   - artifacts: all
     args:
       - "sign"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "${artifact}@${digest}"
       - "--yes" # needed on cosign 2.0.0+
 

goreleaser.other.yaml

@@ -117,12 +117,10 @@ signs:
   - id: cosign
     artifacts: all
     cmd: cosign
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sigstore.json"
     args:
       - "sign-blob"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}" # needed on cosign 3.0.0+
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
   - id: gpg