File tree Expand file tree Collapse file tree 2 files changed +40
-0
lines changed Expand file tree Collapse file tree 2 files changed +40
-0
lines changed Original file line number Diff line number Diff line change 2323
2424  build-pack-publish :
2525    runs-on : windows-latest 
26+     permissions :
27+       contents : read 
28+       id-token : write 
29+     env :
30+       GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }} 
31+       COSIGN_YES : " yes" 
2632
2733    outputs :
2834      artifact-url : ${{ steps.upload-artifacts.outputs.artifact-url }} 
@@ -39,12 +45,33 @@ jobs:
3945    - name : Setup dotnet 
4046      uses : actions/setup-dotnet@v4 
4147
48+     - name : Install Cosign 
49+       uses : sigstore/cosign-installer@v3 
50+       with :
51+         cosign-release : v2.4.0 
52+ 
4253    - name : dotnet restore 
4354      run : dotnet restore ./build/OpenTelemetry.proj -p:RunningDotNetPack=true 
4455
4556    - name : dotnet build 
4657      run : dotnet build ./build/OpenTelemetry.proj --configuration Release --no-restore -p:Deterministic=true -p:BuildNumber=${{ github.run_number }} -p:RunningDotNetPack=true 
4758
59+     - name : Sign DLLs with Cosign Keyless 
60+       shell : pwsh 
61+       run : | 
62+         $projectFiles = Get-ChildItem -Path src/*/*.csproj -File 
63+ 
64+         foreach ($projectFile in $projectFiles) { 
65+             $projectName = [System.IO.Path]::GetFileNameWithoutExtension($projectFile) 
66+ 
67+             Get-ChildItem -Path src/$projectName/bin/Release/*/$projectName.dll -File | ForEach-Object { 
68+                 $fileFullPath = $_.FullName 
69+                 Write-Host "Signing $fileFullPath" 
70+ 
71+                 cosign.exe sign-blob $fileFullPath --yes --output-signature $fileFullPath-keyless.sig --output-certificate $fileFullPath-keyless.pem 
72+             } 
73+         } 
74+ 
4875     - name : dotnet pack 
4976      run : dotnet pack ./build/OpenTelemetry.proj --configuration Release --no-restore --no-build -p:PackTag=${{ github.ref_type == 'tag' && github.ref_name || '' }} 
5077
Original file line number Diff line number Diff line change 6060    <None  Include =" .publicApi\**\PublicAPI.*.txt"   />
6161  </ItemGroup >
6262
63+   <Target  Name =" IncludeSigningSignaturesInPackages"   BeforeTargets =" _GetTargetFrameworksOutput"  >
64+     <!--  Note: This target adds any signatures found to nuget packages --> 
65+     <ItemGroup >
66+       <SignatureFiles  Include =" $(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.sig"   />
67+       <Content  Include =" @(SignatureFiles)"   Link =" %(RecursiveDir)%(Filename)%(Extension)"   PackagePath =" lib"   />
68+       <CertificateFiles  Include =" $(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.pem"   />
69+       <Content  Include =" @(CertificateFiles)"   Link =" %(RecursiveDir)%(Filename)%(Extension)"   PackagePath =" lib"   />
70+     </ItemGroup >
71+ 
72+     <Message  Importance =" high"   Text =" **IncludeSignaturesInPackagesDebug** SignatureFiles: @(SignatureFiles)"   />
73+     <Message  Importance =" high"   Text =" **IncludeCertificatesInPackagesDebug** SignatureFiles: @(CertificateFiles)"   />
74+   </Target >
75+ 
6376  <Target  Name =" AssemblyVersionTarget"   AfterTargets =" MinVer"   Condition =" '$(MinVerVersion)' != '' AND '$(BuildNumber)' != ''"  >
6477    <!--  Note: $(BuildNumber) is typically only set for builds initiated by the
6578    publish workflow. The goal here is to set the assembly FileVersion and 
    
 
   
 
     
   
   
          
     
  
    
     
 
    
      
     
 
     
    You can’t perform that action at this time.
  
 
    
  
     
    
      
        
     
 
       
      
     
   
 
    
    
  
 
  
 
     
    
0 commit comments