Verify checksum file with minisign

[sapphi-red]

Feature Overview

Support for verifying a checksum file with minisign.

Why is the feature needed?

#2994 added support for verifying an artifact with minisign. bufbuild/buf uses minisign to generate a signature, but for a checksum file instead of an artifact.

• https://buf.build/docs/installation > "GitHub" tab > "Verifying a release"

Workaround

No response

Example Code

An example how to use this feature in the registry config:

• Add minisign option under checksum like cosign:

  checksum:
    type: github_release
    asset: sha256.txt
    algorithm: sha256
    minisign:
      type: github_release
      asset: sha256.txt.minisig
      public_key: RWQ/i9xseZwBVE7pEniCNjlNOeeyp4BQgdZDLQcAohxEAH5Uj5DEKjv6

• or, add target option under minisign option:

  minisign:
    target: checksum
    type: github_release
    asset: sha256.txt.minisig
    public_key: RWQ/i9xseZwBVE7pEniCNjlNOeeyp4BQgdZDLQcAohxEAH5Uj5DEKjv6

Not sure which one is better.

Note

No response

[suzuki-shunsuke]

• feat: verify checksum files using minisign #3103

[suzuki-shunsuke]

v2.34.0 is out 🎉
https://github.com/aquaproj/aqua/releases/tag/v2.34.0