run signing as post-build step (#803)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.goreleaser.yaml

@@ -41,6 +41,11 @@ builds:
     mod_timestamp: *build-timestamp
     env: *build-env
     ldflags: *build-ldflags
+    hooks:
+      post:
+        # we must have signing as a build hook instead of the signs section. The signs section must register a new asset, where we want to replace an existing asset.
+        # a post-build hook has the advantage of not needing to unpackage and repackage a tar.gz with a signed binary
+        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
 
   - id: windows-build
     binary: syft
@@ -67,15 +72,6 @@ archives:
     builds:
       - windows-build
 
-signs:
-  - artifacts: archive
-    ids:
-      - darwin-archives
-    cmd: ./.github/scripts/apple-signing/sign.sh
-    args:
-      - "${artifact}"
-      - "{{ .IsSnapshot }}"
-
 nfpms:
   - license: "Apache 2.0"
     maintainer: "Anchore, Inc"