Add workflow to sign release artifacts with Sigstore

AcademySoftwareFoundation / Imath

Imath is a C++ and python library of 2D and 3D vector, matrix, and math operations for computer graphics

https://imath.readthedocs.io

BSD 3-Clause "New" or "Revised" License

356 stars 104 forks source link

Add workflow to sign release artifacts with Sigstore #369

Closed cary-ilm closed 4 months ago

cary-ilm commented 4 months ago

Replicates the openexr workflow: https://github.com/AcademySoftwareFoundation/openexr/pull/1637

lgritz commented 4 months ago

Is there documentation on how the Sigstore approach all works?

Maybe put a comment in the workflow file itself giving the necessary URLs somebody would need to visit to fully understand it, in case other people need to modify or fix it in the future?