chore(deps): update dependency sigstore/cosign to v3.0.4

.gitea/workflows/artifacthub-metadata.yaml

@@ -13,7 +13,7 @@ jobs:
     - uses: actions/checkout@v6.0.2
     - uses: sigstore/cosign-installer@v4.0.0
       with:
-        cosign-release: "v3.0.3" # renovate: datasource=github-tags depName=sigstore/cosign
+        cosign-release: "v3.0.4" # renovate: datasource=github-tags depName=sigstore/cosign
     - uses: docker/login-action@v3.7.0
       with:
         registry: git.cryptic.systems

.gitea/workflows/release.yaml

@@ -33,7 +33,7 @@ jobs:
         rm syft_${SYFT_VERSION}_${OS}_${ARCH}.deb
     - uses: sigstore/cosign-installer@v4.0.0
       with:
-        cosign-release: "v3.0.3" # renovate: datasource=github-tags depName=sigstore/cosign
+        cosign-release: "v3.0.4" # renovate: datasource=github-tags depName=sigstore/cosign
     - uses: docker/setup-qemu-action@v3.7.0
     - uses: docker/setup-buildx-action@v3.12.0
     - uses: actions/setup-go@v6.2.0

.goreleaser.yaml

@@ -104,6 +104,7 @@ dockers_v2:
 
     io.artifacthub.package.alternative-locations: "docker.io/volkerraschek/{{ .ProjectName }}:{{ .Version }}"
     io.artifacthub.package.keywords: "docker,docker-compose,merge,ci"
+    io.artifacthub.package.logo-url: "https://git.cryptic.systems/volker.raschek/{{ .ProjectName }}/raw/tag/v{{ .Version }}/icons/icon.png"
     io.artifacthub.package.license: "MIT"
     io.artifacthub.package.readme-url: "https://git.cryptic.systems/volker.raschek/{{ .ProjectName }}/raw/tag/v{{ .Version }}/README.md"
 
@@ -327,11 +328,14 @@ docker_signs:
   #
   # Default: ["sign", "--key=cosign.key", "${artifact}@${digest}", "--yes"].
   # Templates: allowed.
+  # Note: Using --registry-referrers-mode=legacy ensures signature is stored as sha256-<digest>.sig tag
+  # which is required by ArtifactHub to display the "Signed" badge
   args:
   - "sign"
   - "--key=env://COSIGN_PRIVATE_KEY"
-  - "${artifact}@${digest}"
   - "--yes"
+  - "--registry-referrers-mode=legacy"
+  - "${artifact}@${digest}"
 
   # Which artifacts to sign.
   #
@@ -356,6 +360,8 @@ docker_signs:
   # StdinFile file to be given to the signature command as stdin.
   # stdin_file: ./passphrase.key
 
+  output: true
+
 gitea_urls:
   api: https://git.cryptic.systems/api/v1
   download: https://git.cryptic.systems