Skip to content

Commit 84ff215

Browse files
[BUILD] Signing OpenTelemetry .NET DLLs Using Sigstore certificate (open-telemetry#5880)
Co-authored-by: Mikel Blanchard <[email protected]>
1 parent d45060b commit 84ff215

File tree

2 files changed

+40
-0
lines changed

2 files changed

+40
-0
lines changed

.github/workflows/publish-packages-1.0.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ jobs:
2323

2424
build-pack-publish:
2525
runs-on: windows-latest
26+
permissions:
27+
contents: read
28+
id-token: write
29+
env:
30+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
COSIGN_YES: "yes"
2632

2733
outputs:
2834
artifact-url: ${{ steps.upload-artifacts.outputs.artifact-url }}
@@ -39,12 +45,33 @@ jobs:
3945
- name: Setup dotnet
4046
uses: actions/setup-dotnet@v4
4147

48+
- name: Install Cosign
49+
uses: sigstore/cosign-installer@v3
50+
with:
51+
cosign-release: v2.4.0
52+
4253
- name: dotnet restore
4354
run: dotnet restore ./build/OpenTelemetry.proj -p:RunningDotNetPack=true
4455

4556
- name: dotnet build
4657
run: dotnet build ./build/OpenTelemetry.proj --configuration Release --no-restore -p:Deterministic=true -p:BuildNumber=${{ github.run_number }} -p:RunningDotNetPack=true
4758

59+
- name: Sign DLLs with Cosign Keyless
60+
shell: pwsh
61+
run: |
62+
$projectFiles = Get-ChildItem -Path src/*/*.csproj -File
63+
64+
foreach ($projectFile in $projectFiles) {
65+
$projectName = [System.IO.Path]::GetFileNameWithoutExtension($projectFile)
66+
67+
Get-ChildItem -Path src/$projectName/bin/Release/*/$projectName.dll -File | ForEach-Object {
68+
$fileFullPath = $_.FullName
69+
Write-Host "Signing $fileFullPath"
70+
71+
cosign.exe sign-blob $fileFullPath --yes --output-signature $fileFullPath-keyless.sig --output-certificate $fileFullPath-keyless.pem
72+
}
73+
}
74+
4875
- name: dotnet pack
4976
run: dotnet pack ./build/OpenTelemetry.proj --configuration Release --no-restore --no-build -p:PackTag=${{ github.ref_type == 'tag' && github.ref_name || '' }}
5077

build/Common.prod.props

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,19 @@
6060
<None Include=".publicApi\**\PublicAPI.*.txt" />
6161
</ItemGroup>
6262

63+
<Target Name="IncludeSigningSignaturesInPackages" BeforeTargets="_GetTargetFrameworksOutput">
64+
<!-- Note: This target adds any signatures found to nuget packages -->
65+
<ItemGroup>
66+
<SignatureFiles Include="$(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.sig" />
67+
<Content Include="@(SignatureFiles)" Link="%(RecursiveDir)%(Filename)%(Extension)" PackagePath="lib" />
68+
<CertificateFiles Include="$(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.pem" />
69+
<Content Include="@(CertificateFiles)" Link="%(RecursiveDir)%(Filename)%(Extension)" PackagePath="lib" />
70+
</ItemGroup>
71+
72+
<Message Importance="high" Text="**IncludeSignaturesInPackagesDebug** SignatureFiles: @(SignatureFiles)" />
73+
<Message Importance="high" Text="**IncludeCertificatesInPackagesDebug** SignatureFiles: @(CertificateFiles)" />
74+
</Target>
75+
6376
<Target Name="AssemblyVersionTarget" AfterTargets="MinVer" Condition="'$(MinVerVersion)' != '' AND '$(BuildNumber)' != ''">
6477
<!-- Note: $(BuildNumber) is typically only set for builds initiated by the
6578
publish workflow. The goal here is to set the assembly FileVersion and

0 commit comments

Comments
 (0)