[MGPG-95] don't GPG-sign .sigstore signatures

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.1
• Fix Version/s: 3.1.0
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 25/Apr/23 20:00
• Updated: 01/May/23 07:09
• Resolved: 25/Apr/23 20:04

Description

Signatures done with sigstore are named *.sigstore

and "of course", they don't need to be signed with GPG (we don't need .sigstore.asc files)

Issue Links

• is related to: MNG-7776 don't fingerprint Sigstore signatures (like GPG)
• is related to: MRESOLVER-360 disable checksum by default for .sigstore in addition to .asc

Sub-Tasks

• Update sigstore extension to ".sigstore.json": Closed