Keyless-Signing CLI Artifacts with Sigstore cosign — GitHub Actions OIDC, Bundle Verification, and a Tamper Test

The weakness of out-of-band distribution is that nobody can confirm the artifact they received actually came from that org's workflow and was not modified along the way. Sigstore cosign keyless signing lets you sign artifacts with a GitHub Actions OIDC identity, holding no long-lived signing key. Fulcio issues a short-lived certificate and the signing event lands in a transparency log. By pinning the certificate identity and OIDC issuer, verifiers can confirm that this repository's workflow signed it. We assemble a recipe end to end that signs both the npm .tgz and the Google Drive zip, with a tamper test wired into CI so verification provably fails on modified bytes.