fix signing process (#616)

* fix signing process

* fix reviews

Author: viveksahu26

.goreleaser.yaml

@@ -40,16 +40,15 @@ signs:
   - cmd: cosign
     env:
       - COSIGN_EXPERIMENTAL=1
-    certificate: '${artifact}.pem'
     args:
       - sign-blob
-      - --output-certificate=${certificate}
-      - --output-signature=${signature}
+      - --bundle=${artifact}.bundle
       - ${artifact}
       - --yes
     artifacts: archive
     output: true
 
+
 archives:
   - id: sbomqs
     name_template: >-

docs/getting-started.md

@@ -67,10 +67,16 @@ Download signature and certificate fom release:
 - `sbomqs-linux-amd64.pem`
 
 ```bash
+export VERSION=2.0.3
+
+curl -LO https://github.com/interlynk-io/sbomqs/releases/download/$VERSION/sbomqs_$VERSION_Linux_x86_64.tar.gz
+curl -LO https://github.com/interlynk-io/sbomqs/releases/download/$VERSION/sbomqs_$VERSION_Linux_x86_64.tar.gz.bundle
+
 cosign verify-blob \
-  --certificate sbomqs-linux-amd64.pem \
-  --signature sbomqs-linux-amd64.sig \
-  sbomqs-linux-amd64
+  --bundle sbomqs_$VERSION_Linux_x86_64.tar.gz.bundle \
+  --certificate-identity-regexp='^https://github.com/interlynk-io/sbomqs/\.github/workflows/release\.yml@refs/tags/.*$' \
+  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+  sbomqs_$VERSION_Linux_x86_64.tar.gz
 ```
 
 ### Linux