Updating release to sign checksums

2026-09-06 18:24:57 +08:00 · 2026-04-12 19:39:01 +10:00
parent 0e803833fb
commit c8f6c1a042
2 changed files with 16 additions and 0 deletions
@@ -13,6 +13,11 @@
  then update the FROM line in github-action/Dockerfile with the new digest:
    FROM mikefarah/yq:4@sha256:<new-digest>

+// release artifacts are signed with cosign keyless signing (Sigstore)
+// users can verify with:
+//   cosign verify-blob --bundle checksums.bundle checksums
+// install cosign: brew install cosign  OR  go install github.com/sigstore/cosign/v2/cmd/cosign@latest
+

 - snapcraft
  - update snapcraft version