From 49df3bbdef86df10b79bb2daa16e23397b0d771f Mon Sep 17 00:00:00 2001
From: scttfrdmn <3011922+scttfrdmn@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:53:31 -0700
Subject: [PATCH] fix(#8): sign with cosign --new-bundle-format (Sigstore
 protobuf bundle)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cosign sign-blob --bundle writes the LEGACY bundle format
({base64Signature,cert,rekorBundle}), which sigstore-go — and thus spawn — can't
parse. --new-bundle-format emits the Sigstore protobuf bundle
(application/vnd.dev.sigstore.bundle.v0.3+json) that spawn verifies.

Caught by re-cutting rstudio-server-v1.0.1 through the real workflow: spawn
v0.86.0 rejected the signature ('unknown field base64Signature'). Re-signed
locally with --new-bundle-format → spawn verified it (signature-verified) against
the production sigstore trust root.
---
 .github/workflows/release.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0ff0088..f107304 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -98,7 +98,14 @@ jobs:
           # short-lived Fulcio cert, signs manifest.json, and records the entry in
           # Rekor. The bundle (cert + signature + log proof) is self-contained, so
           # spawn verifies it offline against the sigstore trust root.
+          #
+          # --new-bundle-format emits the Sigstore protobuf bundle (the format
+          # sigstore-go — and thus spawn — parses). Without it, cosign writes the
+          # LEGACY bundle ({base64Signature,cert,rekorBundle}), which spawn's
+          # verifier can't load. The flag is "deprecated" only in the sense that
+          # it will become the sole format in a future cosign; it is required here.
           COSIGN_EXPERIMENTAL=1 cosign sign-blob --yes \
+            --new-bundle-format \
             --bundle manifest.json.sigstore.json \
             manifest.json
           echo "::group::manifest.json.sigstore.json"