cosign(install): use sigstore module to verify signature

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2025-12-16 19:44:35 +01:00
parent 44e7279490
commit eb8ed6b687
3 changed files with 149 additions and 14 deletions
--- a/package.json
+++ b/package.json
@@ -58,6 +58,8 @@
    "@octokit/plugin-rest-endpoint-methods": "^10.4.1",
    "@sigstore/bundle": "^4.0.0",
    "@sigstore/sign": "^4.0.1",
+    "@sigstore/tuf": "^4.0.0",
+    "@sigstore/verify": "^3.0.0",
    "async-retry": "^1.3.3",
    "csv-parse": "^6.1.0",
    "gunzip-maybe": "^1.4.2",