pub const COSIGN_VERSION: &str = "v3.1.3";Expand description
Pinned cosign release used by the cloud-init verify-blob block. Bump in
lockstep with COSIGN_SHA256_AMD64 / COSIGN_SHA256_ARM64 when
upgrading the verifier — supply-chain hygiene (W203 §1.4, R330-F22). v3.x
on purpose: cosign 3’s sigstore-bundle format (--bundle) is current best
practice, replacing the old separate .sig/.cert file pair everywhere
in this pipeline (install.sh, release_manifest.rs, yubaba_fetch.rs).