Add pem as output of goreleaser sign for verification. (#508)

Signed-off-by: Matthias Glastra <[email protected]>
in-toto · Oct 11, 2024 · 18dad87 · 18dad87
1 parent d7d9447
commit 18dad87
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -23,9 +23,12 @@ source:
   enabled: true
 signs:
   - cmd: cosign
+    certificate: '${artifact}.pem'
+    signature: '${artifact}.sig'
     args:
       - "sign-blob"
       - "--output-signature=${signature}"
+      - '--output-certificate=${certificate}'
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
     artifacts: all