Sign the release assets

[hustcer]

Sign the release assets automatically with nfpm config

[hustcer]

RPM 签名在 RHEL 8 上验证失败问题分析

RHEL 8 和 RHEL 9 在 GPG 密钥处理上存在差异，可能导致签名验证失败的原因包括：

• 密钥格式兼容性：RHEL 8 使用较旧版本的 GPG，对某些密钥格式的支持可能有限
• 加密策略不同：RHEL 8 和 9 默认加密策略存在差异
• 导入机制问题：通过 repo 文件自动导入的密钥在 RHEL 8 上可能未正确处理

---

Analysis of RPM Signature Verification Failures on RHEL 8

Differences in GPG key handling between RHEL 8 and RHEL 9 may cause signature verification failures due to:

• Key format compatibility: RHEL 8 uses older GPG versions with limited support for modern key formats
• Different encryption policies: Default cryptographic policies vary between RHEL 8 and 9
• Import mechanism issues: Automatically imported keys through repo files might not be properly handled on RHEL 8

[hustcer]

Rpm install failed for Redhat 8 and RockyLinux 8 after signing: https://github.com/nushell/integrations/actions/runs/13614858875/job/38056623359#step:3:53
So I'm not going to sign the rpm packages unless we want to drop Redhat 8 and RockyLinux 8 support

[hustcer]

Maybe we can use cosign to sign the artifacts just like nfpm: https://nfpm.goreleaser.com/install/#verifying-the-artifacts