Sigstore's tooling moved on: cosign v3 replaced the separate signature and certificate outputs with a single bundle that carries both. FerrFlow releases follow suit. Every artifact: the platform tarballs and zips, the completions archive, the SBOM: now ships one <artifact>.bundle sidecar instead of a .sig + .crt pair.

Verification loses a flag:

cosign verify-blob \
  --bundle ferrflow-linux-x64.tar.gz.bundle \
  --certificate-identity-regexp "https://github.com/FerrLabs/FerrFlow/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ferrflow-linux-x64.tar.gz

If you verify releases in CI, this is the change to make. A pipeline that downloads <artifact>.sig and <artifact>.crt will fail on v5.48.0 and later, because those files are no longer published. Releases up to v5.47.4 are untouched and still verify with --certificate and --signature. Nothing was removed retroactively.

The hosted API follows the same rule: GET /v1/ferrflow/latest now returns bundle_url for releases that have one, and keeps returning signature_url and cert_url for the older releases that carry them, so a client can simply use whichever field is present.