From 974c121d223120ae707d1236bf1ebd1d27ae8205 Mon Sep 17 00:00:00 2001
From: Jordan Petridis <16531710+alatiera@users.noreply.github.com>
Date: Fri, 22 Aug 2025 20:47:22 +0300
Subject: docs: Skip password promot during cosign key generation (#131)

The key in GH secret requires that its not password protected in order to work.

Add COSIGN_PASSWORD="" in the example command so everyone that copy pastes it avoids the prompt they have to
manually ignore otherwise.
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'README.md')

diff --git a/README.md b/README.md
index 490c5e6..e890f6a 100644
--- a/README.md
+++ b/README.md
@@ -49,10 +49,10 @@ First, install the [cosign CLI tool](https://edu.chainguard.dev/open-source/sigs
 With the cosign tool installed, run inside your repo folder:
 
 ```bash
-cosign generate-key-pair
+COSIGN_PASSWORD="" cosign generate-key-pair
 ```
 
-Do NOT put in a password when it asks you to, just press enter. The signing key will be used in GitHub Actions and will not work if it is encrypted.
+The signing key will be used in GitHub Actions and will not work if it is password protected.
 
 > [!WARNING]
 > Be careful to *never* accidentally commit `cosign.key` into your git repo. If this key goes out to the public, the security of your repository is compromised.
-- 
cgit v1.2.3