Add checksum signing

.github/workflows/release.yml

@@ -8,6 +8,7 @@ on:
 permissions:
   contents: write
   packages: write
+  id-token: write
 
 jobs:
   Release:
@@ -36,6 +37,8 @@ jobs:
         uses: actions/setup-go@v4
         with:
           go-version: '1.21'
+      - name: Cosign install
+        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 #v3.1.2
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:

.goreleaser.yml

@@ -96,3 +96,15 @@ brews:
     homepage: "https://github.com/trufflesecurity/trufflehog"
     install: |
       bin.install "trufflehog"
+signs:
+  - cmd: cosign
+    signature: "${artifact}.sig"
+    certificate: "${artifact}.pem"
+    args: 
+      - "sign-blob"
+      - "--oidc-issuer=https://token.actions.githubusercontent.com"
+      - "--output-certificate=${certificate}"
+      - "--output-signature=${signature}"
+      - "${artifact}"
+      - "--yes"
+    artifacts: checksum