ci: sign goreleaser artifacts

Signed-off-by: Carlos Alexandro Becker <caarlos0@gmail.com>

.github/workflows/build.yml

@@ -95,6 +95,7 @@ jobs:
           TWITTER_CONSUMER_SECRET: ${{ secrets.TWITTER_CONSUMER_SECRET }}
           TWITTER_ACCESS_TOKEN: ${{ secrets.TWITTER_ACCESS_TOKEN }}
           TWITTER_ACCESS_TOKEN_SECRET: ${{ secrets.TWITTER_ACCESS_TOKEN_SECRET }}
+          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
           FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
         run: |
           if [[ $GITHUB_REF == refs/tags/v* ]]; then

.goreleaser.yml

@@ -160,6 +160,16 @@ snapcrafts:
     confinement: classic
     publish: true
 
+signs:
+- cmd: cosign
+  stdin: '{{ .Env.COSIGN_PWD }}'
+  args: ["sign-blob", "-key=cosign.key", "-output=${signature}", "${artifact}"]
+  artifacts: checksum
+
+docker_signs:
+- artifacts: manifests
+  stdin: '{{ .Env.COSIGN_PWD }}'
+
 publishers:
   - name: fury.io
     ids:

cosign.key

@@ -1,11 +1,11 @@
 -----BEGIN ENCRYPTED COSIGN PRIVATE KEY-----
 eyJrZGYiOnsibmFtZSI6InNjcnlwdCIsInBhcmFtcyI6eyJOIjozMjc2OCwiciI6
-OCwicCI6MX0sInNhbHQiOiJ4ZGhNcWtrc0ErN2F4VU1YcmlVTXFrZW9vWVhGYkhG
-b2hWcERJQnM4bEFzPSJ9LCJjaXBoZXIiOnsibmFtZSI6Im5hY2wvc2VjcmV0Ym94
-Iiwibm9uY2UiOiJKYkFYVGQrZWh0bTVnZGtYN3JNYkl1SjlsT3A3azF3eCJ9LCJj
-aXBoZXJ0ZXh0IjoiNnlRZ29sL2doSFEvTnN3bWszZFN3WmhZdGNkK1lvekFGenpr
-emFNa2YxT0dxVGphdVJlRGQyeDZtOXZQek1mL2pHV0NEeHY0VGo3eFVOblI3OUhE
-UitKNmU1SUduNTBuRkoxNDlVTUk3aWhHeXVDYWJzckZtZTJhZVhaNTRDeFczNjRi
-KzVSU1g0SkMxYUNKMlhneEJjVklRbzN0U1VpeDZuRG9zaUZEMWJVUTB5UDVCZ05K
-Qnp3dnRsMHBSNVFjQXNCaEM2aHNjQ1VXOXc9PSJ9
+OCwicCI6MX0sInNhbHQiOiJtUWdJMGhQZTVLdDlkMVFYTEE0YXcrTHArZzZFWnVP
+MmJnOElMUXg1RVFjPSJ9LCJjaXBoZXIiOnsibmFtZSI6Im5hY2wvc2VjcmV0Ym94
+Iiwibm9uY2UiOiJXeU5xVmRGTlk0YlZYMEdEK0lnTHZjZ3ZwN0Ribno5eCJ9LCJj
+aXBoZXJ0ZXh0IjoiSUhMa2lBV0xtK0hUQUFrUXFKdE5vWmNVQlJTblBRYWxhY3hG
+UlZTVjNOcWhMTUFPeXZndGx0MUlZVGZCTnJJTmhwYU1LZHRsazEyN1FSWEVRZUl2
+TDBTNFp6OElsUGZkMkR3U1B1ejQ2L3RxWEFLRld0YURRbEhLemhLK1BYUC9qU2Yv
+aDdMTWh6Tms1V0FtK091bHBOL09ScDBicVhRYkQ1WnBpYVZoRno3RlFHVHIvNTFr
+OXBrdlNDaWhQM1A0SUNZOE02T2pHaU1Ecnc9PSJ9
 -----END ENCRYPTED COSIGN PRIVATE KEY-----

cosign.pub

@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdOGf+JZhlk/D16pf3iR14cEjtGdn
-/3N3NDg1Ic7+bm/3ccxvrH8WfkqXftxeSzQ9ICqFdr5DVsufVp7mY5pvdw==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1cDYntBbC5z3yV9Os6R6VdYAF2yt
+0tjp4kg12QbnN95kv2m1WTmwg4TBRd4bwYCfhCyEEJEAWAUGsWtFflzl5g==
 -----END PUBLIC KEY-----