debt: Updated notes to reflect latest signature verification steps

Author: mprimeaux

.goreleaser.yaml

@@ -106,33 +106,34 @@ checksum:
   name_template: 'checksums.txt'
 
 # Ref: https://goreleaser.com/customization/sign/
+# Ref: https://goreleaser.com/blog/cosign-v3/
 signs:
   - id: source
     cmd: cosign
     stdin: '{{ .Env.COSIGN_PASSWORD }}'
     output: true
     artifacts: source
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - --yes
       - --key
       - env://COSIGN_PRIVATE_KEY
-      - '--output-certificate=${certificate}'
-      - '--output-signature=${signature}'
+      - "--bundle=${signature}"
       - '${artifact}'
 
   - id: checksums
     cmd: cosign
     stdin: '{{ .Env.COSIGN_PASSWORD }}'
     output: true
     artifacts: checksum
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - --yes
       - --key
       - env://COSIGN_PRIVATE_KEY
-      - '--output-certificate=${certificate}'
-      - '--output-signature=${signature}'
+      - "--bundle=${signature}"
       - '${artifact}'
 
 # Ref: https://goreleaser.com/customization/source/

README.md

@@ -109,27 +109,46 @@ For a detailed mapping between the implementation and NIST SP 800-90A requiremen
 To verify the integrity of the release tarball, you can use Cosign to check the signature and checksums. Follow these steps:
 
 ```sh
-# Fetch the latest release tag from GitHub API (e.g., "v1.9.0")
+# Fetch the latest release tag from GitHub API (e.g., "v1.13.0")
 TAG=$(curl -s https://api.github.com/repos/sixafter/aes-ctr-drbg/releases/latest | jq -r .tag_name)
 
-# Remove leading "v" for filenames (e.g., "v1.9.0" -> "1.9.0")
+# Remove leading "v" for filenames (e.g., "v1.13.0" -> "1.13.0")
 VERSION=${TAG#v}
 
-# Verify the release tarball
+# ---------------------------------------------------------------------
+# Verify the source archive using Sigstore bundles
+# ---------------------------------------------------------------------
+
+# Download the release tarball and its corresponding bundle
+curl -LO https://github.com/sixafter/aes-ctr-drbg/releases/download/${TAG}/aes-ctr-drbg-${VERSION}.tar.gz
+curl -LO https://github.com/sixafter/aes-ctr-drbg/releases/download/${TAG}/aes-ctr-drbg-${VERSION}.tar.gz.bundle.json
+
+# Verify the tarball with Cosign using your published public key
 cosign verify-blob \
   --key https://raw.githubusercontent.com/sixafter/aes-ctr-drbg/main/cosign.pub \
-  --signature aes-ctr-drbg-${VERSION}.tar.gz.sig \
-  aes-ctr-drbg-${VERSION}.tar.gz
+  --bundle aes-ctr-drbg-${VERSION}.tar.gz.bundle.json \
+  prng-chacha-${VERSION}.tar.gz
+
+# ---------------------------------------------------------------------
+# Verify the checksums manifest using Sigstore bundles
+# ---------------------------------------------------------------------
 
-# Download checksums.txt and its signature from the latest release assets
+# Download checksums.txt and its bundle
 curl -LO https://github.com/sixafter/aes-ctr-drbg/releases/download/${TAG}/checksums.txt
-curl -LO https://github.com/sixafter/aes-ctr-drbg/releases/download/${TAG}/checksums.txt.sig
+curl -LO https://github.com/sixafter/aes-ctr-drbg/releases/download/${TAG}/checksums.txt.bundle.json
 
-# Verify checksums.txt with cosign
+# Verify checksums.txt with Cosign using your public key
 cosign verify-blob \
   --key https://raw.githubusercontent.com/sixafter/aes-ctr-drbg/main/cosign.pub \
-  --signature checksums.txt.sig \
+  --bundle checksums.txt.bundle.json \
   checksums.txt
+
+# ---------------------------------------------------------------------
+# Confirm local artifact integrity
+# ---------------------------------------------------------------------
+
+# Compute and validate checksums locally
+shasum -a 256 -c checksums.txt
 ```
 
 If valid, Cosign will output: