Skip to content

Commit dd05d2d

Browse files
martincostellomartincostello
authored
[Infra] Fix missing signatures from .nupkg files (#6591)
1 parent fca9ed8 commit dd05d2d

File tree

3 files changed

+54
-12
lines changed

3 files changed

+54
-12
lines changed

‎.github/workflows/publish-packages-1.0.yml‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ jobs:
3232
id-token: write
3333
env:
3434
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35+
# renovate: datasource=github-releases depName=cosign packageName=sigstore/cosign
36+
COSIGN_VERSION: v2.5.3
3537
COSIGN_YES: "yes"
3638

3739
outputs:
@@ -52,7 +54,7 @@ jobs:
5254
- name: Install Cosign
5355
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
5456
with:
55-
cosign-release: v2.5.3
57+
cosign-release: ${{ env.COSIGN_VERSION }}
5658

5759
- name: dotnet restore
5860
run: dotnet restore ./build/OpenTelemetry.proj -p:RunningDotNetPack=true
@@ -71,7 +73,7 @@ jobs:
7173
7274
Get-ChildItem -Path artifacts/bin/$projectName/release_*/$projectName.dll -File | ForEach-Object {
7375
$fileFullPath = $_.FullName
74-
Write-Host "Signing $fileFullPath"
76+
Write-Output "Signing $fileFullPath"
7577
7678
cosign.exe sign-blob $fileFullPath --yes --output-signature $fileFullPath-keyless.sig --output-certificate $fileFullPath-keyless.pem
7779
}
@@ -83,6 +85,38 @@ jobs:
8385
PACK_TAG: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
8486
run: dotnet pack ./build/OpenTelemetry.proj --configuration Release --no-restore --no-build -p:"PackTag=${env:PACK_TAG}"
8587

88+
- name: Verify package DLL Cosign Keyless signatures
89+
shell: pwsh
90+
run: |
91+
$nupkgFiles = Get-ChildItem -Path artifacts/package/release/*.nupkg -File
92+
93+
# Copy the NuGet packages to a temporary directory and extract them
94+
$tempDir = New-Item -ItemType Directory -Path (Join-Path -Path ${env:RUNNER_TEMP} -ChildPath ([System.Guid]::NewGuid().ToString()))
95+
foreach ($nupkgFile in $nupkgFiles) {
96+
$nupkgFilePath = $nupkgFile.FullName
97+
$packageName = [System.IO.Path]::GetFileNameWithoutExtension($nupkgFilePath)
98+
Write-Output "Extracting $nupkgFilePath"
99+
Expand-Archive -Path $nupkgFilePath -DestinationPath (Join-Path $tempDir.FullName $packageName)
100+
}
101+
102+
# Iterate over all DLL files in the extracted packages and verify their signatures
103+
$dllFiles = Get-ChildItem -Path $tempDir.FullName -Recurse -Filter *.dll -File
104+
foreach ($dllFile in $dllFiles) {
105+
$dllFilePath = $dllFile.FullName
106+
Write-Output "Verifying $dllFilePath"
107+
cosign.exe verify-blob `
108+
--signature $dllFilePath-keyless.sig `
109+
--certificate $dllFilePath-keyless.pem `
110+
--certificate-identity "${env:GITHUB_SERVER_URL}/${env:GITHUB_REPOSITORY}/.github/workflows/publish-packages-1.0.yml@${env:GITHUB_REF}" `
111+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" `
112+
$dllFilePath
113+
if ($LASTEXITCODE -ne 0) {
114+
Write-Output "::error::Signature verification failed for $dllFilePath."
115+
exit 1
116+
}
117+
Write-Output "Signature verification succeeded for $dllFilePath"
118+
}
119+
86120
- name: Publish Artifacts
87121
id: upload-artifacts
88122
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

‎README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -201,10 +201,11 @@ To verify the integrity of a DLL inside a NuGet package use the
201201
[cosign](https://github.com/sigstore/cosign) tool from Sigstore:
202202

203203
```bash
204+
$TAG="core-1.12.0"
204205
cosign verify-blob \
205206
--signature OpenTelemetry.dll-keyless.sig \
206-
--certificate OpenTelemetry.dll-keyless.pem.cer \
207-
--certificate-identity "https://github.com/open-telemetry/opentelemetry-dotnet/.github/workflows/publish-packages-1.0.yml@refs/tags/core-1.10.0-rc.1" \
207+
--certificate OpenTelemetry.dll-keyless.pem \
208+
--certificate-identity "https://github.com/open-telemetry/opentelemetry-dotnet/.github/workflows/publish-packages-1.0.yml@refs/tags/$TAG" \
208209
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
209210
OpenTelemetry.dll
210211
```

‎build/Common.prod.props‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -52,16 +52,23 @@
5252
</ItemGroup>
5353

5454
<Target Name="IncludeSigningSignaturesInPackages" BeforeTargets="_GetTargetFrameworksOutput">
55-
<!-- Note: This target adds any signatures found to nuget packages -->
55+
<!-- Note: This target adds any signatures found to NuGet packages -->
5656
<ItemGroup>
57-
<SignatureFiles Include="$(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.sig" />
58-
<Content Include="@(SignatureFiles)" Link="%(RecursiveDir)%(Filename)%(Extension)" PackagePath="lib" />
59-
<CertificateFiles Include="$(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.pem" />
60-
<Content Include="@(CertificateFiles)" Link="%(RecursiveDir)%(Filename)%(Extension)" PackagePath="lib" />
57+
<SignatureFiles Include="$(ArtifactsPath)\bin\$(MSBuildProjectName)\$(Configuration.ToLower())_*\$(MSBuildProjectName).dll-keyless.sig" />
58+
<CertificateFiles Include="$(ArtifactsPath)\bin\$(MSBuildProjectName)\$(Configuration.ToLower())_*\$(MSBuildProjectName).dll-keyless.pem" />
59+
<!-- RecursiveDir is equal to e.g. `release_net8.0` so we need to strip it out -->
60+
<SignatureFilesWithTfm Include="@(SignatureFiles)">
61+
<TargetFramework>$([System.String]::Copy('%(RecursiveDir)').Replace(`$(Configuration.ToLower())_`, ''))</TargetFramework>
62+
</SignatureFilesWithTfm>
63+
<CertificateFilesWithTfm Include="@(CertificateFiles)">
64+
<TargetFramework>$([System.String]::Copy('%(RecursiveDir)').Replace(`$(Configuration.ToLower())_`, ''))</TargetFramework>
65+
</CertificateFilesWithTfm>
66+
<Content Include="@(SignatureFilesWithTfm)" Pack="True" PackagePath="lib\%(SignatureFilesWithTfm.TargetFramework)%(Filename)%(Extension)" />
67+
<Content Include="@(CertificateFilesWithTfm)" Pack="True" PackagePath="lib\%(CertificateFilesWithTfm.TargetFramework)%(Filename)%(Extension)" />
6168
</ItemGroup>
6269

63-
<Message Importance="high" Text="**IncludeSignaturesInPackagesDebug** SignatureFiles: @(SignatureFiles)" />
64-
<Message Importance="high" Text="**IncludeCertificatesInPackagesDebug** SignatureFiles: @(CertificateFiles)" />
70+
<Message Importance="high" Text="**IncludeSignaturesInPackagesDebug** SignatureFiles: @(SignatureFilesWithTfm)" />
71+
<Message Importance="high" Text="**IncludeCertificatesInPackagesDebug** CertificateFiles: @(CertificateFilesWithTfm)" />
6572
</Target>
6673

6774
<Target Name="AssemblyVersionTarget" AfterTargets="MinVer" Condition="'$(MinVerVersion)' != '' AND '$(BuildNumber)' != ''">
@@ -96,7 +103,7 @@
96103

97104
<Target Name="IncludeReadmeAndReleaseNotesInPackages" BeforeTargets="_GetTargetFrameworksOutput">
98105
<!-- Note: This target runs during pack to convert relative links in
99-
markdowns into github permalinks which will work when rendered on Nuget. -->
106+
markdowns into GitHub permalinks which will work when rendered on NuGet. -->
100107

101108
<Exec
102109
Command="git rev-parse HEAD"

0 commit comments

Comments
 (0)