From f63d9cb217af6412c3d5bb8028c6d7445bac0383 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Skytt=C3=A4?= <ville.skytta@iki.fi>
Date: Mon, 22 Jun 2026 23:02:55 +0300
Subject: [PATCH] release: generate sigstore bundles rather than certs and
 signatures

The latter two are deprecated as of cosign 3.1.1,
ref https://github.com/sigstore/cosign/releases/tag/v3.1.1
---
 .goreleaser.yml | 6 ++----
 README.md       | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 73716d42c..1f3767128 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -24,14 +24,12 @@ checksum:
   name_template: 'checksums.txt'
 signs:
   - cmd: cosign
-    signature: '${artifact}.keyless.sig'
-    certificate: '${artifact}.pem'
+    signature: '${artifact}.sigstore.json'
     output: true
     artifacts: checksum
     args:
       - sign-blob
-      - '--output-certificate=${certificate}'
-      - '--output-signature=${signature}'
+      - '--bundle=${signature}'
       - '${artifact}'
       - --yes
 release:
diff --git a/README.md b/README.md
index 7e4e7a751..d7d000880 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ sha256sum --ignore-missing -c checksums.txt
 [Cosign](https://github.com/sigstore/cosign) `verify-blob` command ensures that the release was built with GitHub Actions in this repository.
 
 ```console
-cosign verify-blob --certificate=checksums.txt.pem --signature=checksums.txt.keyless.sig --certificate-identity-regexp="^https://github.com/terraform-linters/tflint" --certificate-oidc-issuer=https://token.actions.githubusercontent.com checksums.txt
+cosign verify-blob --bundle=checksums.txt.sigstore.json --certificate-identity-regexp="^https://github.com/terraform-linters/tflint" --certificate-oidc-issuer=https://token.actions.githubusercontent.com checksums.txt
 sha256sum --ignore-missing -c checksums.txt
 ```