From f4c5640f4574857bbfac0c73e26f0dc85efabb26 Mon Sep 17 00:00:00 2001 From: lukasWuttke <54042461+LukasWodka@users.noreply.github.com> Date: Wed, 29 Jul 2026 08:57:37 +0200 Subject: [PATCH] fix(install.ps1): anchor cosign identity to version tags (parity with #415) install.sh rejects signatures from non-tag workflow runs; install.ps1 still accepted @.* -- Windows trusted what Unix refused. Same anchor now: refs/tags/v.* (covers rc tags too). Co-Authored-By: Claude Opus 4.8 --- scripts/install.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/install.ps1 b/scripts/install.ps1 index ab8f84b0..cc63714b 100644 --- a/scripts/install.ps1 +++ b/scripts/install.ps1 @@ -163,7 +163,7 @@ try { # exception. & invokes cosign as an external process, # which doesn't interact with $ErrorActionPreference. & cosign verify-blob ` - --certificate-identity-regexp "https://github.com/$GitHubRepo/.github/workflows/release.yml@.*" ` + --certificate-identity-regexp "https://github.com/$GitHubRepo/.github/workflows/release.yml@refs/tags/v.*" ` --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' ` --certificate (Join-Path $tmpDir "$binaryFile.cert") ` --signature (Join-Path $tmpDir "$binaryFile.sig") `