search

AcademySoftwareFoundation / OpenImageIO

Reading, writing, and processing images in a wide variety of file formats, using a format-agnostic API, aimed at VFX applications.
https://openimageio.readthedocs.org
Apache License 2.0
1.98k stars 597 forks source link

Consider signing release artifacts #4404

Open cary-ilm opened 2 months ago

cary-ilm commented 2 months ago

The OpenSSF Best Practices Badge suggests signing release artifacts. Consider using OpenEXR's release-sign.yml workflow as a template. It's triggered on release creation and does these steps:

  1. Runs get archive to generate a <release>.tar.gz artifact
  2. Signs the <release>.tar.gz via sigstore
  3. Uploads the resulting sigstore signature file along with the tarball.