Add signing of the builds.

2026-06-05 22:49:25 +00:00 · 2025-12-15 00:43:42 +00:00
parent 3a48a67c75
commit 49a46a74c1
3 changed files with 40 additions and 0 deletions
@@ -146,6 +146,25 @@ jobs:
 docker pull ghcr.io/lukaszraczylo/semver-generator:latest
 ```

+#### Verifying Release Signatures
+
+All release checksums and Docker images are signed with [cosign](https://github.com/sigstore/cosign) using keyless signing. To verify:
+
+```bash
+# Verify checksum signature
+cosign verify-blob \
+  --certificate-identity-regexp "https://github.com/lukaszraczylo/semver-generator/.*" \
+  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+  --bundle "<checksums-file>.sigstore.json" \
+  <checksums-file>
+
+# Verify Docker image
+cosign verify \
+  --certificate-identity-regexp "https://github.com/lukaszraczylo/semver-generator/.*" \
+  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+  ghcr.io/lukaszraczylo/semver-generator:latest
+```
+
 **Docker supported architectures:**
 Linux/arm64, Linux/amd64