fix: Revert to cosign v2.6.1 for release signing

Author: twpayne

.config/goreleaser.yaml

@@ -281,11 +281,10 @@ scoops:
 signs:
 - cmd: cosign
   stdin: '{{ .Env.COSIGN_PWD }}'
-  signature: ${artifact}.sigstore.json
   args:
   - sign-blob
   - --key=assets/cosign/cosign.key
-  - --bundle=${signature}
+  - --output-signature=${signature}
   - --yes
   - ${artifact}
   artifacts: checksum

.github/workflows/main.yml

@@ -16,7 +16,7 @@ concurrency:
 env:
   AGE_VERSION: 1.3.1 # https://github.com/FiloSottile/age/releases
   CHOCOLATEY_VERSION: 2.6.0 # https://github.com/chocolatey/choco/releases
-  COSIGN_VERSION: 3.0.3 # https://github.com/sigstore/cosign/releases
+  COSIGN_VERSION: 2.6.1 # https://github.com/sigstore/cosign/releases
   GO_VERSION: 1.25.5 # https://go.dev/doc/devel/release
   GOLANGCI_LINT_VERSION: 2.7.2 # https://github.com/golangci/golangci-lint/releases
   GORELEASER_VERSION: 2.13.2 # https://github.com/goreleaser/goreleaser/releases