Sign the release assets

[hustcer]

Sign the release assets automatically with nfpm config

[hustcer]

RPM 签名在 RHEL 8 上验证失败问题分析

RHEL 8 和 RHEL 9 在 GPG 密钥处理上存在差异，可能导致签名验证失败的原因包括：

• 密钥格式兼容性：RHEL 8 使用较旧版本的 GPG，对某些密钥格式的支持可能有限
• 加密策略不同：RHEL 8 和 9 默认加密策略存在差异
• 导入机制问题：通过 repo 文件自动导入的密钥在 RHEL 8 上可能未正确处理

---

Analysis of RPM Signature Verification Failures on RHEL 8

Differences in GPG key handling between RHEL 8 and RHEL 9 may cause signature verification failures due to:

• Key format compatibility: RHEL 8 uses older GPG versions with limited support for modern key formats
• Different encryption policies: Default cryptographic policies vary between RHEL 8 and 9
• Import mechanism issues: Automatically imported keys through repo files might not be properly handled on RHEL 8

[hustcer]

Rpm install failed for Redhat 8 and RockyLinux 8 after signing: https://github.com/nushell/integrations/actions/runs/13614858875/job/38056623359#step:3:53
So I'm not going to sign the rpm packages unless we want to drop Redhat 8 and RockyLinux 8 support

[hustcer]

Maybe we can use cosign to sign the artifacts just like nfpm: https://nfpm.goreleaser.com/install/#verifying-the-artifacts

[RulentWave]

I haven't tested this but if gpgcheck=0 in the repo, then it should install even on rhel 8. If you start signing the rpm packages and then just let people know in the documentation that they have to turn off package verification by setting gpgcheck=0 if they're using older distros that don't support new keys, then that allows people on modern releases to benefit from signed packages