#!/usr/bin/env bash
set -euox pipefail

TAG=v1.26.0-rc.1
URL=https://dl.k8s.io/release/$TAG/bin/linux/amd64
BIN=kubectl

for EXT in "" .sig .cert; do
    FILE=$BIN$EXT
    curl -sSfL --retry 3 --retry-delay 3 $URL/$FILE -o $FILE
done

COSIGN_EXPERIMENTAL=1 cosign verify-blob $BIN --signature $BIN.sig --certificate $BIN.cert