Validating CachyOS' .sig file (not gpg)

Install cosign. If it's not in your distro, it's in brew. Download CachyOS' cosign public key and save as cosign.pub Download the .sig file for the iso. It's the lock icon when you got the iso. cosign verify-blob --key cosign.pub iso file --signature .sig file Apparently --signature has been deprecated but still works for now. The .sig file is not in the correct format for --bundle as far as I can tell. Thank you, Game_in_Theory.