sign release artifacts using cosign

Signed-off-by: Prashant Rewar <108176843+prashantrewar@users.noreply.github.com>

.github/workflows/release.yml

@@ -21,6 +21,9 @@ jobs:
         uses: actions/setup-go@v3
         with:
           go-version: "1.21.3"
+
+      - name: Set up Cosign
+        uses: sigstore/cosign-installer@v3    
 
       - name: Retrieve version
         run: |
@@ -89,6 +92,14 @@ jobs:
             ${checksums['ytt-linux-amd64']}  ./ytt-linux-amd64
             ${checksums['ytt-linux-arm64']}  ./ytt-linux-arm64
             ${checksums['ytt-windows-amd64.exe']}  ./ytt-windows-amd64.exe`
+      
+      - name: Verify checksums signature
+        run: |
+          cosign verify-blob \
+            --cert dist/checksums.txt.pem \
+            --signature dist/checksums.txt.sig \
+            --certificate-identity-regexp=https://github.com/${{ github.repository_owner }} \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com ./dist/checksums.txt
 
       - name: verify uploaded artifacts
         if: startsWith(github.ref, 'refs/tags/')

.goreleaser.yml

@@ -34,6 +34,17 @@ checksum:
   name_template: 'checksums.txt'
   algorithm: sha256
   disable: false
+signs:
+  - artifacts: checksum
+    certificate: '${artifact}.pem'
+    cmd: cosign
+    args:
+      - sign-blob
+      - "--yes"
+      - '--output-certificate=${certificate}'
+      - '--output-signature=${signature}'
+      - '${artifact}'
+    output: true  
 snapshot:
   name_template: "{{ .Tag }}-next"
 release: