release: switch signing sidecars to sigstore bundles (#358)

## Summary
- switch shared release signing from legacy `.sig` / `.pem` sidecars to
Sigstore bundle sidecars
- update direct installers to verify `*.sigstore.json` bundles with
`cosign verify-blob --bundle`
- align release contracts and public docs with the new bundle-only
direct install flow

## Evidence
- fixes the `release-nodeup` failure in GitHub Actions where `cosign
v3.0.5` rejected the old `sign-blob` invocation
- local smoke test with `cosign v3.0.5` now produces `SHA256SUMS` plus
`*.sigstore.json` and verifies successfully

## Current Gap
- release automation still emitted legacy sidecars that are incompatible
with the current `cosign` behavior
- direct installer scripts and docs still referenced `.sig` / `.pem`
artifacts

## Proposed Scope
- update `scripts/release/generate-checksums.sh` to emit bundle sidecars
only
- update shell and PowerShell direct installers for `nodeup`, `derun`,
and `dexdex`
- update docs and public docs pages to document bundle-only direct
installs

## Acceptance Criteria
- release workflows publish `SHA256SUMS` and `*.sigstore.json` sidecars
without legacy `.sig` / `.pem` files
- direct installers verify bundle sidecars successfully
- docs and public docs match the new release artifact contract

## Test Scenarios
- `bash -n scripts/release/generate-checksums.sh
scripts/install/nodeup.sh scripts/install/derun.sh
scripts/install/dexdex-stack.sh`
- local `cosign v3.0.5` smoke test for bundle generation and
`verify-blob --bundle`
- `pnpm --filter public-docs test`

## Out of Scope
- republishing `nodeup@v0.1.10`
- legacy installer fallback for historical `.sig` / `.pem`-only releases

Author: kdy1

apps/public-docs/derun.mdx

@@ -43,6 +43,8 @@ Script installer:
 ./scripts/install/derun.ps1 -Version latest -Method direct
 ```
 
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and only support bundle-enabled releases.
+
 ## Quick start
 
 Run a command with transcript capture:

apps/public-docs/dexdex.mdx

@@ -44,6 +44,8 @@ Script installer:
 ./scripts/install/dexdex-stack.ps1 -Version latest -Method direct
 ```
 
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and only support bundle-enabled releases.
+
 ## Related pages
 
 - [Projects Overview](projects-overview)

apps/public-docs/nodeup.mdx

@@ -42,6 +42,8 @@ Script installer:
 ./scripts/install/nodeup.ps1 -Version latest -Method direct
 ```
 
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and only support bundle-enabled releases.
+
 ## Common workflows
 
 Set a global default runtime:

docs/cmds-derun-foundation.md

@@ -19,9 +19,11 @@
 - Release artifact contract for distribution tooling:
   - Required asset names: `derun-linux-amd64.tar.gz`, `derun-darwin-amd64.tar.gz`, `derun-darwin-arm64.tar.gz`, `derun-windows-amd64.zip`.
   - Required build matrix: `linux/amd64`, `darwin/amd64`, `darwin/arm64`, `windows/amd64`.
+  - Required signing sidecars: `SHA256SUMS.sigstore.json` and `<artifact>.sigstore.json`.
 - Homebrew `derun` formula contract:
   - Must install from GitHub release prebuilt tarballs (darwin amd64/arm64 and linux amd64).
   - Linux arm64 must fail explicitly as unsupported until a dedicated artifact is added.
+- Direct install scripts must verify release artifacts with `SHA256SUMS` and Sigstore bundle sidecars via `cosign verify-blob --bundle`.
 - User-facing error messages must remain single-line and follow stable style contracts:
   - Usage/validation: `invalid arguments: <reason>; details: <k=v,...>; hint: <how to fix>`
   - Runtime: `failed to <action>: <cause>; details: <k=v,...>`

docs/crates-cargo-mono-foundation.md

@@ -66,11 +66,12 @@
 - Workspace validation baseline: `cargo test --workspace --all-targets`
 - CI alignment: `.github/workflows/CI.yml` Rust jobs
 - Release contract checks should align with `.github/workflows/release-cargo-mono.yml`.
+- Release signing outputs must use Sigstore bundle sidecars (`SHA256SUMS.sigstore.json` and `<artifact>.sigstore.json`).
 
 ## Dependencies and Integrations
 - Integrates with Cargo workspace metadata and release workflows.
 - Integrates with root automation (`auto-publish`) through stable command contracts, including CI-driven tag publication.
-- Integrates with tag-based binary distribution automation (`release-cargo-mono`) through stable artifact naming and signing contracts.
+- Integrates with tag-based binary distribution automation (`release-cargo-mono`) through stable artifact naming and bundle-signing contracts.
 
 ## Change Triggers
 - Update `docs/project-cargo-mono.md` with this file when command identifiers or ownership changes.

docs/crates-nodeup-foundation.md

@@ -18,6 +18,7 @@
 - Shim dispatch behavior must remain deterministic by executable name (`node`, `npm`, `npx`, `yarn`, `pnpm`).
 - Install/update command surfaces must preserve backward-compatible flags and outputs.
 - Homebrew installation must consume prebuilt release archives for `darwin/amd64`, `darwin/arm64`, and `linux/amd64`; Linux arm64 must fail with a clear unsupported-platform message.
+- Direct install scripts must verify release artifacts with `SHA256SUMS` and Sigstore bundle sidecars (`<artifact>.sigstore.json`) via `cosign verify-blob --bundle`.
 - `yarn`/`pnpm` delegated execution must honor nearest `package.json` `packageManager` when present.
 - `packageManager` parsing contract is strict: `<manager>@<exact-semver>` with manager limited to `yarn|pnpm`.
 - `packageManager` manager-command mismatch must fail with `conflict`; malformed values must fail with `invalid-input`.
@@ -53,6 +54,7 @@
 - Workspace baseline: `cargo test --workspace --all-targets`
 - Release contract checks should align with `release-nodeup` workflow expectations.
 - Release assets must include both standalone prebuilt binaries (`nodeup-<os>-<arch>[.exe]`) and compressed archives (`nodeup-<os>-<arch>.tar.gz|zip`) for the supported release matrix.
+- Release signing outputs must include `SHA256SUMS.sigstore.json` and `<artifact>.sigstore.json` sidecars; legacy `.sig`/`.pem` sidecars are out of scope for direct installation.
 - Homebrew release automation must render the prebuilt formula from release asset URLs and push tap updates directly to `delinoio/homebrew-tap` `main` with a dedicated tap-write credential.
 - Completion coverage must include successful script generation, invalid shell/scope validation, and JSON-mode raw output behavior.
 - Output color coverage must include flag/env precedence, invalid env fallback, stream-aware auto-mode behavior, and JSON/completion ANSI exclusion.

docs/project-cargo-mono.md

@@ -21,7 +21,7 @@ Provide a Cargo subcommand for Rust monorepo lifecycle management, including ver
 - `publish` retry overrides must remain operator-controlled through `--max-attempts <count>` and `CARGO_MONO_PUBLISH_MAX_ATTEMPTS`, with precedence `--max-attempts` > env > default unlimited retries.
 - Remote tag publication remains CI-owned: `auto-publish` pushes release tags with `git push --tags` after a successful `publish` run, with checkout credential persistence disabled and authentication bound to `secrets.GH_TOKEN` (non-`GITHUB_TOKEN`) so downstream tag-triggered workflows run.
 - Publish tag configuration must be opt-in through `[workspace.metadata.cargo-mono.publish.tag].packages`, and tag naming must remain `<crate>@v<version>`.
-- Tag release automation must detect `cargo-mono@v*` and produce signed multi-OS prebuilt artifacts without changing CLI command behavior.
+- Tag release automation must detect `cargo-mono@v*` and produce signed multi-OS prebuilt artifacts with Sigstore bundle sidecars (`*.sigstore.json`) without changing CLI command behavior.
 - Runtime failure messaging must follow the `Summary/Context/Hint` three-line contract while command behavior, output schema, and exit code semantics remain stable.
 - Dependency-cycle conflicts in package ordering must identify cycle package names and dependency scope in `Context` without changing CLI flags, command behavior, or JSON output schema.
 - Human output color controls must remain stable: global `--color <auto|always|never>`, `CARGO_MONO_OUTPUT_COLOR`, and `NO_COLOR` with precedence `--color` > `CARGO_MONO_OUTPUT_COLOR` > `NO_COLOR` > auto-detection.

docs/project-derun.md

@@ -18,12 +18,14 @@ Provide a Go CLI that preserves terminal fidelity for AI-agent workflows and bri
 - User-facing error messages must remain single-line and include deterministic `details` segments with safe diagnostic fields only (no secrets).
 - User-facing error messages must preserve compatibility tokens used by MCP/automation integrations (`session not found`, `parse <field>`, `session_id is required`, `cursor is required`).
 - Release artifact matrix and names must remain stable: `derun-linux-amd64.tar.gz`, `derun-darwin-amd64.tar.gz`, `derun-darwin-arm64.tar.gz`, `derun-windows-amd64.zip`.
+- Release signing must publish Sigstore bundle sidecars (`*.sigstore.json`) for each artifact and `SHA256SUMS`, and direct installers only support bundle-enabled releases.
 - Homebrew distribution must install `derun` from GitHub release prebuilt archives (darwin amd64/arm64 and linux amd64) instead of source builds.
 
 ## Change Policy
 - Update this index and `docs/cmds-derun-foundation.md` together whenever command shape or runtime contracts change.
 - Update this index and `docs/cmds-derun-foundation.md` together whenever user-facing error message contracts or compatibility tokens change.
 - Update `.github/workflows/release-derun.yml`, `scripts/release/update-homebrew.sh`, and `packaging/homebrew/templates/derun.rb.tmpl` in the same change when derun release artifact names, target matrix, or package-manager distribution contracts change.
+- Keep direct installer contracts in `scripts/install/derun.sh` and `scripts/install/derun.ps1` synchronized with release signing changes.
 - Align command lifecycle changes with `cmds/AGENTS.md` and root `AGENTS.md`.
 
 ## References

docs/project-dexdex.md

@@ -139,7 +139,8 @@ Recommended runtime environment keys:
 
 ## Release Distribution Contracts
 - Release workflow: `.github/workflows/release-dexdex.yml`.
-- GitHub Releases publish signed desktop and server artifacts (`SHA256SUMS` + cosign signatures).
+- GitHub Releases publish signed desktop and server artifacts (`SHA256SUMS` + `.sigstore.json` bundle sidecars).
+- Direct installers verify Sigstore bundle sidecars and only support bundle-enabled releases.
 - Homebrew distribution:
   - `dexdex` cask consumes the macOS desktop DMG release artifact.
   - `dexdex-main-server` and `dexdex-worker-server` formulas consume prebuilt server release artifacts for `darwin/amd64`, `darwin/arm64`, and `linux/amd64`.

docs/project-nodeup.md

@@ -18,7 +18,8 @@ Provide a Rust-based Node.js version manager with predictable channel resolution
 - `package.json` `packageManager` support for `yarn|pnpm` must remain strict and deterministic.
 - Shell completion generation must remain deterministic for supported shells and top-level command scopes.
 - Human output styling controls (`--color`, `NODEUP_COLOR`, and `NO_COLOR` precedence) must remain stable across CLI and public documentation.
-- Release automation must publish both standalone prebuilt binaries and archive assets for the supported OS/architecture matrix.
+- Release automation must publish both standalone prebuilt binaries and archive assets for the supported OS/architecture matrix, plus Sigstore bundle sidecars (`*.sigstore.json`) for each artifact and `SHA256SUMS`.
+- Direct installers must verify `SHA256SUMS` entries and Sigstore bundle sidecars, and only support bundle-enabled releases.
 - Homebrew installation must use prebuilt `nodeup` release archives for `darwin/amd64`, `darwin/arm64`, and `linux/amd64`, while failing clearly for unsupported Linux arm64 hosts.
 
 ## Change Policy