Carlos Alexandro Becker 4b462d3d1d feat: verify release checksum and cosign signature (#550) ... * feat: verify release checksum and cosign signature Download checksums.txt for the release and verify the SHA-256 of the downloaded archive against it. When cosign is available in PATH, also download checksums.txt.sigstore.json and verify the signature against the goreleaser/goreleaser-pro release workflow identity. Both steps degrade gracefully (with a warning) when the corresponding artifacts or tooling are missing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: use install() for checksum e2e tests Drop the http-client download helper from verifyChecksum integration tests; call goreleaser.install() instead so the test exercises the public API path and avoids duplicating download logic. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>		2026-04-18 14:34:46 -03:00
..
index.js	feat: verify release checksum and cosign signature (#550)	2026-04-18 14:34:46 -03:00
licenses.txt	chore(deps): bump the npm group across 1 directory with 4 updates (#536)	2026-01-29 21:59:39 -03:00
package.json	feat!: node 24, update deps, rm yarn, ESM (#533)	2026-01-29 21:22:39 -03:00