fix

.gitea/workflows/artifacthub-metadata.yaml

@@ -38,6 +38,7 @@ jobs:
         echo "${COSIGN_PUBLIC_KEY}" > cosign.pub
         oras push git.cryptic.systems/volker.raschek/dcmerge-goreleaser:cosign.pub \
           --artifact-type application/vnd.dev.cosign.public-key.v1 \
+          --annotation org.opencontainers.image.title=cosign.pub \
           cosign.pub:application/vnd.dev.cosign.public-key.v1
 
     # - name: Push artifacthub-repo.yml to docker.io

.goreleaser.yaml

@@ -325,11 +325,14 @@ docker_signs:
   #
   # Default: ["sign", "--key=cosign.key", "${artifact}@${digest}", "--yes"].
   # Templates: allowed.
+  # Note: Using --registry-referrers-mode=legacy ensures signature is stored as sha256-<digest>.sig tag
+  # which is required by ArtifactHub to display the "Signed" badge
   args:
   - "sign"
   - "--key=env://COSIGN_PRIVATE_KEY"
-  - "${artifact}@${artifactID}.sig"
   - "--yes"
+  - "--registry-referrers-mode=legacy"
+  - "${artifact}@${digest}"
 
   # Which artifacts to sign.
   #
@@ -354,6 +357,8 @@ docker_signs:
   # StdinFile file to be given to the signature command as stdin.
   # stdin_file: ./passphrase.key
 
+  output: true
+
 gitea_urls:
   api: https://git.cryptic.systems/api/v1
   download: https://git.cryptic.systems