Cosign check failed on stable release of tofu

[claytonsilva]

Describe the bug
Cosign check failed on stable release of tofu
Cosign check failed on stable release of tofu when added --skip-signature

To Reproduce
Steps to reproduce the behavior:

1. tenv tofu install latest or tenv tofu install -s
2. See error

2026-06-08T14:46:23.920-0300 [DEBUG] tenv: cosign output: stdOut=""
  stdErr=
  | Flag --signature has been deprecated, please use --bundle to provide a signature
  | Flag --certificate has been deprecated, please use --bundle with --trusted-root to provide the public certificate
  | Error: searching log query: &{0 } (*models.Error) is not supported by the TextConsumer, can be resolved by supporting TextUnmarshaler interface
  | error during command execution: searching log query: &{0 } (*models.Error) is not supported by the TextConsumer, can be resolved by supporting TextUnmarshaler interface

Expected behavior
Expected to pass, but not pass

Environment (please complete the following information):

• OS: MacOS
• tofuenv version 4.12.1

[kvendingoldo]

Hi! Thank you for the issue. Can you try the latest version of tenv and cosign, please? I can't reproduce it:

tenv tofu install 1.12.0
Installing OpenTofu 1.12.0
Fetching release information from https://api.github.com/repos/opentofu/opentofu/releases/tags/v1.12.0
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.0/tofu_1.12.0_darwin_arm64.zip
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.0/tofu_1.12.0_SHA256SUMS
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.0/tofu_1.12.0_SHA256SUMS.sig
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.0/tofu_1.12.0_SHA256SUMS.pem
Installation of OpenTofu 1.12.0 successful

[claytonsilva]

❯ tenv tofu install 1.12.1 --skip-signature
Installing OpenTofu 1.12.1
Fetching release information from https://api.github.com/repos/opentofu/opentofu/releases/tags/v1.12.1
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_darwin_arm64.zip
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_SHA256SUMS
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_SHA256SUMS.sig
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_SHA256SUMS.pem
Error: cosign check failed

❯ tenv tofu install 1.12.1
Installing OpenTofu 1.12.1
Fetching release information from https://api.github.com/repos/opentofu/opentofu/releases/tags/v1.12.1
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_darwin_arm64.zip
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_SHA256SUMS
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_SHA256SUMS.sig
Downloading https://github.com/opentofu/opentofu/releases/download/v1.12.1/tofu_1.12.1_SHA256SUMS.pem
Error: cosign check failed

Cosign = 3.1.2
Tenv = 4.14.8

[claytonsilva]

Tenv and cosign with latest version, for some reason in arm64, cosign cant work and --skip-signature cannot work.

[claytonsilva]

#619

[dvaumoron]

thanks @claytonsilva