.gz.spdx.sig" target="_blank">cri-o.s390x.v1.29.3.tar.gz.spdx.sig</a></li>
<li><a href="https://storage.googleapis.com/cri-o/artifacts/cri-o.s390x.v1.29.3.tar.gz.spdx.cert" target="_blank">cri-o.s390x.v1.29.3.tar.gz.spdx.cert</a></li>
</ul></li>
</ul>

<p>To verify the artifact signatures via <a href="https://github.com/sigstore/cosign" target="_blank">cosign</a>, run:</p>

<pre><code class="language-console">&gt; export COSIGN_EXPERIMENTAL=1
&gt; cosign verify-blob cri-o.amd64.v1.29.3.tar.gz \
    --certif