Skip to content

Unable to verify the latest release signature with cosign #2518

@baprx

Description

@baprx

Description

Unable to verify the latest release signature with cosign:

❯ cosign verify-blob \
        --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
        --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
        --bundle 'checksums.txt.sigstore.json' \
        ./checksums.txt
Error: failed to verify signature: could not verify message: invalid signature when validating ASN.1 encoded signature
error during command execution: failed to verify signature: could not verify message: invalid signature when validating ASN.1 encoded signature

As a result, the version is not available on Aqua registry: aquaproj/aqua-registry#51130

Version

v0.53.0

Environment

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions