Fix sigstore dependency and update to v0.1.8

* Bump sigstore/gh-action-sigstore-python from 2.1.1 to 3.0.0

Bumps [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) from 2.1.1 to 3.0.0.
- [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases)
- [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md)
- [Commits](sigstore/gh-action-sigstore-python@v2.1.1...v3.0.0)

---
updated-dependencies:
- dependency-name: sigstore/gh-action-sigstore-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* update to v0.1.8

* update to new json format

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: anishnaik <anish.naik@trailofbits.com>

.github/workflows/ci.yml

@@ -82,7 +82,7 @@ jobs:
 
       - name: Sign artifact
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
-        uses: sigstore/gh-action-sigstore-python@v2.1.1
+        uses: sigstore/gh-action-sigstore-python@v3.0.0
         with:
           inputs: ./medusa-*.tar.gz
 
@@ -92,7 +92,7 @@ jobs:
           name: medusa-${{ runner.os }}-${{ runner.arch }}
           path: |
             ./medusa-*.tar.gz
-            ./medusa-*.tar.gz.sigstore
+            ./medusa-*.tar.gz.sigstore.json
 
   release:
     needs: [build]
@@ -117,7 +117,7 @@ jobs:
           name: "${{ github.ref_name }}"
           files: |
             ./medusa-*.tar.gz
-            ./medusa-*.tar.gz.sigstore
+            ./medusa-*.tar.gz.sigstore.json
 
   lint:
     runs-on: ubuntu-latest

cmd/root.go

@@ -7,7 +7,7 @@ import (
 	"os"
 )
 
-const version = "0.1.7"
+const version = "0.1.8"
 
 // rootCmd represents the root CLI command object which all other commands stem from.
 var rootCmd = &cobra.Command{