Consider signing release artifacts

AcademySoftwareFoundation / openvdb

OpenVDB - Sparse volume data structure and tools

http://www.openvdb.org/

Apache License 2.0

2.71k stars 660 forks source link

Consider signing release artifacts #1888

Open cary-ilm opened 2 months ago

cary-ilm commented 2 months ago

The OpenSSF Best Practices Badge suggests signing release artifacts. Consider using OpenEXR's release-sign.yml workflow as a template. It's triggered on release creation and does these steps:

Runs get archive to generate a <release>.tar.gz artifact
Signs the <release>.tar.gz via sigstore
Uploads the resulting sigstore signature file along with the tarball.