From 34611c8d70dd3fa77721d24266038da9eebec85a Mon Sep 17 00:00:00 2001
From: DSR! <xchwarze@gmail.com>
Date: Wed, 2 Sep 2026 19:09:24 -0300
Subject: [PATCH] fix sign generation

---
 .github/workflows/sign.yml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/sign.yml b/.github/workflows/sign.yml
index d4e19f9..77ecedb 100644
--- a/.github/workflows/sign.yml
+++ b/.github/workflows/sign.yml
@@ -71,14 +71,11 @@ jobs:
             return await core.getIDToken('sigstore');
 
       - name: Keyless sign installers
-        env:
-          COSIGN_EXPERIMENTAL: '1'
         run: |
           for exe in artifacts/*.exe; do
             ./cosign sign-blob --yes \
               --identity-token "${{ steps.oidc.outputs.result }}" \
-              --output-signature "${exe}.sig" \
-              --output-certificate "${exe}.pem" \
+              --bundle "${exe}.sigstore.json" \
               "$exe"
           done
 
@@ -88,15 +85,14 @@ jobs:
             ./cosign verify-blob \
               --certificate-identity-regexp "https://github\\.com/${{ github.repository }}/.*" \
               --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-              --signature "${exe}.sig" \
-              --certificate "${exe}.pem" \
+              --bundle "${exe}.sigstore.json" \
               "$exe"
           done
 
       - name: Package signatures
         run: |
           cd artifacts
-          zip -j "cosign-signatures-${{ steps.tag.outputs.result }}.zip" *.exe.sig *.exe.pem
+          zip -j "cosign-signatures-${{ steps.tag.outputs.result }}.zip" *.exe.sigstore.json
 
       - name: Publish signatures
         uses: softprops/action-gh-release@v2