fix: sign all artifacts

I think it's okay to sign all artifacts instead of just the checksum
shibumi · Dec 23, 2021 · 621b166 · 621b166
1 parent 2f69939
commit 621b166
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -27,8 +27,7 @@ checksum:
   name_template: 'checksums.txt'
 
 sboms:
-  - id: default
-    artifacts: archive
+  - artifacts: archive
   - id: source
     artifacts: source
 
@@ -40,7 +39,7 @@ signs:
     signature: "${artifact}.sig"
     certificate: "${artifact}.pem"
     args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output-signature=${signature}", "--output-certificate=${certificate}", "${artifact}"]
-    artifacts: checksum
+    artifacts: all
 
 changelog:
   use: github