AcademySoftwareFoundation / AcademySoftwareFoundation/OpenTimelineIO
Support for signed source releases
- Dominant language
- C++
- Stars
- 2k
- Forks
- 351
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 1
Description
Several ASWF projects have implemented signed source releases. For instance in OpenEXR:
https://github.com/AcademySoftwareFoundation/openexr/blob/main/.github/workflows/release-sign.yml
This has a few advantages:
- immutable source release, even if the release tag gets modified after the fact
- visible SHA-256 checksum for the tarball
- ability to programmatically verify authenticity of the tarball
Unfortunately there doesn't seem to be a way to prevent the automatically generated links for unsigned .tar.gz and .zip archives from showing up.
Contributor guide
Research direction
Start by reviewing the signed-release workflow shown in OpenEXR at .github/workflows/release-sign.yml, then locate OpenTimelineIO’s source-release workflow and generated archive configuration. Determine how signed archives and SHA-256 checksums should be published while addressing the automatically generated unsigned links; done means the release artifacts can be programmatically verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100