From 9aa2cbcb2601377afdacb948466a511f70347a5b Mon Sep 17 00:00:00 2001 From: martincostello Date: Thu, 2 Jul 2026 13:42:47 +0100 Subject: [PATCH 01/11] [Infra] Digitally sign DLLs with cosign Copy the approach for the .NET SDK and sign the assemblies in the NuGet packages with a cosign keyless blob. Resolves #4603. --- .github/workflows/publish-packages.yml | 63 ++++++++++++++++++++++++++ README.md | 34 ++++++++++++++ build/Common.prod.props | 14 ++++++ 3 files changed, 111 insertions(+) diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml index 196f799b0a..9d7d632e22 100644 --- a/.github/workflows/publish-packages.yml +++ b/.github/workflows/publish-packages.yml @@ -32,8 +32,13 @@ jobs: build-pack: name: Build and pack + if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.event.repository.fork == false) runs-on: windows-2025 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + COSIGN_YES: "yes" + outputs: artifact-url: ${{ steps.upload-artifacts.outputs.artifact-url }} artifact-id: ${{ steps.upload-artifacts.outputs.artifact-id }} @@ -107,6 +112,25 @@ jobs: - name: dotnet test ${{ steps.resolve-project.outputs.title }} run: dotnet test ${env:PROJECT_PATH} --configuration Release --no-restore --no-build + - name: Install Cosign + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + + - name: Sign DLLs with Cosign Keyless + shell: pwsh + run: | + $projectFiles = Get-ChildItem -Path src/*/*.csproj -File + + foreach ($projectFile in $projectFiles) { + $projectName = [System.IO.Path]::GetFileNameWithoutExtension($projectFile) + + Get-ChildItem -Path artifacts/bin/$projectName/release_*/$projectName.dll -File | ForEach-Object { + $fileFullPath = $_.FullName + Write-Output "Signing $fileFullPath" + + cosign.exe sign-blob --yes --bundle "$fileFullPath.sigstore.json" $fileFullPath + } + } + - name: Create GitHub attestations for DLLs uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 with: @@ -169,6 +193,9 @@ jobs: with: dotnet-version: ${{ needs.build-pack.outputs.dotnet-sdk-version }} + - name: Install Cosign + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - name: Install NuGet package validation tools env: # renovate: datasource=nuget depName=dotnet-validate @@ -219,6 +246,42 @@ jobs: exit 1 } + - name: Verify package DLL Cosign Keyless signatures + shell: pwsh + env: + CERTIFICATE_IDENTITY: "${{ github.server_url }}/${{ github.repository }}/.github/workflows/publish-packages.yml@${{ github.ref }}" + CERTIFICATE_OIDC_ISSUER: "https://token.actions.githubusercontent.com" + COSIGN_YES: "yes" + run: | + $nupkgFiles = Get-ChildItem -Path "./artifacts/*.nupkg" -File + + # Copy the NuGet packages to a temporary directory and extract them + $tempDir = New-Item -ItemType Directory -Path (Join-Path -Path ${env:RUNNER_TEMP} -ChildPath ([System.Guid]::NewGuid().ToString())) + foreach ($nupkgFile in $nupkgFiles) { + $nupkgFilePath = $nupkgFile.FullName + $packageName = [System.IO.Path]::GetFileNameWithoutExtension($nupkgFilePath) + Write-Output "Extracting $nupkgFilePath" + Expand-Archive -Path $nupkgFilePath -DestinationPath (Join-Path $tempDir.FullName $packageName) + } + + # Iterate over all DLL files in the extracted packages and verify their signatures + $dllFiles = Get-ChildItem -Path $tempDir.FullName -Recurse -Filter *.dll -File + foreach ($dllFile in $dllFiles) { + $dllFilePath = $dllFile.FullName + Write-Output "Verifying $dllFilePath" + cosign.exe verify-blob ` + --bundle "$dllFilePath.sigstore.json" ` + --certificate-identity ${env:CERTIFICATE_IDENTITY} ` + --certificate-oidc-issuer ${env:CERTIFICATE_OIDC_ISSUER} ` + --use-signed-timestamps ` + $dllFilePath + if ($LASTEXITCODE -ne 0) { + Write-Output "::error::Signature verification failed for $dllFilePath." + exit 1 + } + Write-Output "Signature verification succeeded for $dllFilePath" + } + - name: Verify artifact attestations shell: pwsh env: diff --git a/README.md b/README.md index deaba5cb34..72fe7cc094 100644 --- a/README.md +++ b/README.md @@ -143,6 +143,40 @@ Nightly builds from this repo are published to [MyGet](https://www.myget.org), and can be installed using the `https://www.myget.org/F/opentelemetry/api/v3/index.json` source. +## Digital signing + +Starting with the `1.17.*` releases the DLLs included in the packages pushed to +NuGet are digitally signed using [Sigstore](https://www.sigstore.dev/). Within +each NuGet package the digital signature artifacts are placed alongside the +shipped DLL(s) in the `/lib` folder. When a project targets multiple frameworks +each target outputs a dedicated DLL and signing artifacts into a sub folder +based on the [TFM](https://learn.microsoft.com/dotnet/standard/frameworks). + +The digital signature files share the same name prefix as the DLL to ensure +easy identification and association. + +To verify the integrity of a DLL inside a NuGet package use the +[cosign](https://github.com/sigstore/cosign) tool from Sigstore. + +Signatures use the bundle format known from cosign 3.0+. + +```bash +$TAG="Instrumentation.AspNetCore-1.17.0" +$PACKAGE="OpenTelemetry.Instrumentation.AspNetCore" +cosign verify-blob \ + --bundle "${PACKAGE}.dll.sigstore.json" \ + --certificate-identity "https://github.com/open-telemetry/opentelemetry-dotnet-contrib/.github/workflows/publish-packages.yml@refs/tags/${TAG}" \ + --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ + --use-signed-timestamps \ + "${PACKAGE}.dll" +``` + +> [!NOTE] +> A successful verification outputs `Verify OK`. + +For more verification options please refer to the [cosign +documentation](https://github.com/sigstore/cosign/blob/main/doc/cosign_verify-blob.md). + ## Attestation Starting with the `1.14.*` releases the DLLs included in the packages pushed to diff --git a/build/Common.prod.props b/build/Common.prod.props index ebefef9fe3..f79bb996f1 100644 --- a/build/Common.prod.props +++ b/build/Common.prod.props @@ -140,4 +140,18 @@ + + + + + + + $([System.String]::Copy('%(RecursiveDir)').Replace(`$(Configuration.ToLower())_`, '')) + + + + + + + From fcae85a10be4b5e14a9a2db52edb6617b7f30b6c Mon Sep 17 00:00:00 2001 From: Martin Costello Date: Thu, 2 Jul 2026 14:13:44 +0100 Subject: [PATCH 02/11] [Infra] Fix cosign verification Run on Windows to fix the signature verification. --- .github/workflows/publish-packages.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml index 9d7d632e22..224a070f58 100644 --- a/.github/workflows/publish-packages.yml +++ b/.github/workflows/publish-packages.yml @@ -181,7 +181,7 @@ jobs: validate: name: Validate NuGet packages needs: [build-pack] - runs-on: ubuntu-24.04 + runs-on: windows-2025 permissions: attestations: read # Verify GitHub attestations for the build outputs From f83313a953a780399ad9b59c01547a1160d1d645 Mon Sep 17 00:00:00 2001 From: martincostello Date: Thu, 2 Jul 2026 15:29:50 +0100 Subject: [PATCH 03/11] [Infra] Handle single-TFM packages Handle finding the TFM to use for cosign when the package only has one TFM. --- build/Common.prod.props | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/build/Common.prod.props b/build/Common.prod.props index f79bb996f1..e90110e932 100644 --- a/build/Common.prod.props +++ b/build/Common.prod.props @@ -143,10 +143,17 @@ + - + + + + - $([System.String]::Copy('%(RecursiveDir)').Replace(`$(Configuration.ToLower())_`, '')) + <_RecursiveDir>$([System.String]::Copy('%(RecursiveDir)').TrimEnd('\','/')) + + $([System.String]::Copy('%(_RecursiveDir)').Substring($([System.String]::Copy('$(Configuration.ToLower())_').Length))) + $(TargetFramework) From a35423c7029d1556b4d2ce0606f74bc11c4ab78f Mon Sep 17 00:00:00 2001 From: martincostello Date: Thu, 2 Jul 2026 16:06:53 +0100 Subject: [PATCH 04/11] [Infra] Fix target Fix-up target for handling multi and single TFM packages correctly. --- build/Common.prod.props | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/build/Common.prod.props b/build/Common.prod.props index e90110e932..7bf21273b2 100644 --- a/build/Common.prod.props +++ b/build/Common.prod.props @@ -143,22 +143,24 @@ - + - - - - - - <_RecursiveDir>$([System.String]::Copy('%(RecursiveDir)').TrimEnd('\','/')) - - $([System.String]::Copy('%(_RecursiveDir)').Substring($([System.String]::Copy('$(Configuration.ToLower())_').Length))) - $(TargetFramework) - - + + + + + + + $([System.String]::Copy('%(RecursiveDir)').Replace('\', '').Replace('/', '').Replace('$(Configuration.ToLower())_', '')) + + + $(TargetFramework) + + - - + From 3a4f17964fc1a41ec958ee0ecfa9e33b958f70a0 Mon Sep 17 00:00:00 2001 From: martincostello Date: Thu, 2 Jul 2026 16:37:12 +0100 Subject: [PATCH 05/11] [Infra] Fix missing signatures Update patterns to handle DLLs for projects that only produce one TFM. --- .github/workflows/publish-packages.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml index 224a070f58..9d688c7a1d 100644 --- a/.github/workflows/publish-packages.yml +++ b/.github/workflows/publish-packages.yml @@ -123,7 +123,7 @@ jobs: foreach ($projectFile in $projectFiles) { $projectName = [System.IO.Path]::GetFileNameWithoutExtension($projectFile) - Get-ChildItem -Path artifacts/bin/$projectName/release_*/$projectName.dll -File | ForEach-Object { + Get-ChildItem -Path artifacts/bin/$projectName/release*/$projectName.dll -File | ForEach-Object { $fileFullPath = $_.FullName Write-Output "Signing $fileFullPath" @@ -135,7 +135,7 @@ jobs: uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 with: subject-path: | - ./artifacts/bin/*/release_*/OpenTelemetry*.dll + ./artifacts/bin/*/release*/OpenTelemetry*.dll !./artifacts/bin/*/**/OpenTelemetry.dll !./artifacts/bin/*/**/OpenTelemetry.Api.dll !./artifacts/bin/*/**/OpenTelemetry.Api.ProviderBuilderExtensions.dll From cca616fc823be0ccdc8b2c73275552d7c45a3093 Mon Sep 17 00:00:00 2001 From: martincostello Date: Thu, 2 Jul 2026 17:33:54 +0100 Subject: [PATCH 06/11] [Infra] Address feedback Skip directories that were not built. --- .github/workflows/publish-packages.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml index 9d688c7a1d..62b86d67f7 100644 --- a/.github/workflows/publish-packages.yml +++ b/.github/workflows/publish-packages.yml @@ -123,7 +123,15 @@ jobs: foreach ($projectFile in $projectFiles) { $projectName = [System.IO.Path]::GetFileNameWithoutExtension($projectFile) - Get-ChildItem -Path artifacts/bin/$projectName/release*/$projectName.dll -File | ForEach-Object { + $dllSearchPath = "artifacts/bin/$projectName/release*/$projectName.dll" + + # Components that were not built (e.g. in tag/component + # builds) will not have any output, so skip them. + if (-not (Test-Path -Path $dllSearchPath)) { + continue + } + + Get-ChildItem -Path $dllSearchPath -File | ForEach-Object { $fileFullPath = $_.FullName Write-Output "Signing $fileFullPath" From b8e9d91841b6a93d55c3887bfb9c9cc9a6a1b337 Mon Sep 17 00:00:00 2001 From: Martin Costello Date: Thu, 2 Jul 2026 21:41:13 +0100 Subject: [PATCH 07/11] [Infra] Apply suggestions from code review Change version to date. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 72fe7cc094..f37792334b 100644 --- a/README.md +++ b/README.md @@ -145,7 +145,7 @@ and can be installed using the ## Digital signing -Starting with the `1.17.*` releases the DLLs included in the packages pushed to +For releases published since July 3rd 2026 the DLLs included in the packages pushed to NuGet are digitally signed using [Sigstore](https://www.sigstore.dev/). Within each NuGet package the digital signature artifacts are placed alongside the shipped DLL(s) in the `/lib` folder. When a project targets multiple frameworks From af047afe3491202062197c1bdd1abb0f46fdd4c6 Mon Sep 17 00:00:00 2001 From: Martin Costello Date: Thu, 2 Jul 2026 21:47:16 +0100 Subject: [PATCH 08/11] [Infra] Fix lint warning Make markdownlint happy with line lengths. --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index f37792334b..257cd69d79 100644 --- a/README.md +++ b/README.md @@ -145,12 +145,12 @@ and can be installed using the ## Digital signing -For releases published since July 3rd 2026 the DLLs included in the packages pushed to -NuGet are digitally signed using [Sigstore](https://www.sigstore.dev/). Within -each NuGet package the digital signature artifacts are placed alongside the -shipped DLL(s) in the `/lib` folder. When a project targets multiple frameworks -each target outputs a dedicated DLL and signing artifacts into a sub folder -based on the [TFM](https://learn.microsoft.com/dotnet/standard/frameworks). +For releases published since July 3rd 2026 the DLLs included in the packages +pushed to NuGet are digitally signed using [Sigstore](https://www.sigstore.dev/). +Within each NuGet package the digital signature artifacts are placed alongside +the shipped DLL(s) in the `/lib` folder. When a project targets multiple +frameworks each target outputs a dedicated DLL and signing artifacts into a +sub folder based on the [TFM](https://learn.microsoft.com/dotnet/standard/frameworks). The digital signature files share the same name prefix as the DLL to ensure easy identification and association. From 05d27b3c6826554a2101f634426882807ef0e45f Mon Sep 17 00:00:00 2001 From: Martin Costello Date: Fri, 3 Jul 2026 11:37:14 +0100 Subject: [PATCH 09/11] [Infra] Update CHANGELOGs Add an entry for this PR to every CHANGELOG. --- src/OpenTelemetry.Exporter.Geneva/CHANGELOG.md | 3 +++ src/OpenTelemetry.Exporter.InfluxDB/CHANGELOG.md | 3 +++ src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md | 3 +++ src/OpenTelemetry.Extensions.AWS/CHANGELOG.md | 3 +++ .../CHANGELOG.md | 3 +++ src/OpenTelemetry.Extensions.Enrichment.Http/CHANGELOG.md | 3 +++ src/OpenTelemetry.Extensions.Enrichment/CHANGELOG.md | 3 +++ src/OpenTelemetry.Extensions/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.AWS/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.AWSLambda/CHANGELOG.md | 3 +++ .../CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.AspNet/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Cassandra/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.ConfluentKafka/CHANGELOG.md | 3 +++ .../CHANGELOG.md | 3 +++ .../CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.EventCounters/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.GrpcCore/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.GrpcNetClient/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Hangfire/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Http/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Kusto/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Owin/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Process/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Quartz/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Remoting/CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Runtime/CHANGELOG.md | 3 +++ .../CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.SqlClient/CHANGELOG.md | 3 +++ .../CHANGELOG.md | 3 +++ src/OpenTelemetry.Instrumentation.Wcf/CHANGELOG.md | 3 +++ src/OpenTelemetry.OpAmp.Client/CHANGELOG.md | 3 +++ src/OpenTelemetry.PersistentStorage.Abstractions/CHANGELOG.md | 3 +++ src/OpenTelemetry.PersistentStorage.FileSystem/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.AWS/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.Azure/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.Container/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.Gcp/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.Host/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.OperatingSystem/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.Process/CHANGELOG.md | 3 +++ src/OpenTelemetry.Resources.ProcessRuntime/CHANGELOG.md | 3 +++ src/OpenTelemetry.Sampler.AWS/CHANGELOG.md | 3 +++ 44 files changed, 132 insertions(+) diff --git a/src/OpenTelemetry.Exporter.Geneva/CHANGELOG.md b/src/OpenTelemetry.Exporter.Geneva/CHANGELOG.md index 72e53378bf..fdb3003091 100644 --- a/src/OpenTelemetry.Exporter.Geneva/CHANGELOG.md +++ b/src/OpenTelemetry.Exporter.Geneva/CHANGELOG.md @@ -15,6 +15,9 @@ temporary arrays/strings. ([#4498](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4498)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.2 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Exporter.InfluxDB/CHANGELOG.md b/src/OpenTelemetry.Exporter.InfluxDB/CHANGELOG.md index a25619e9c0..7a2c56d78e 100644 --- a/src/OpenTelemetry.Exporter.InfluxDB/CHANGELOG.md +++ b/src/OpenTelemetry.Exporter.InfluxDB/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.0.0-alpha.8 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md b/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md index d87959cedf..639d94d8e2 100644 --- a/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md +++ b/src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Extensions.AWS/CHANGELOG.md b/src/OpenTelemetry.Extensions.AWS/CHANGELOG.md index 56a7beafc4..9d109024db 100644 --- a/src/OpenTelemetry.Extensions.AWS/CHANGELOG.md +++ b/src/OpenTelemetry.Extensions.AWS/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-18 diff --git a/src/OpenTelemetry.Extensions.Enrichment.AspNetCore/CHANGELOG.md b/src/OpenTelemetry.Extensions.Enrichment.AspNetCore/CHANGELOG.md index ffe55dee92..52a72df473 100644 --- a/src/OpenTelemetry.Extensions.Enrichment.AspNetCore/CHANGELOG.md +++ b/src/OpenTelemetry.Extensions.Enrichment.AspNetCore/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.2 Released 2026-Apr-23 diff --git a/src/OpenTelemetry.Extensions.Enrichment.Http/CHANGELOG.md b/src/OpenTelemetry.Extensions.Enrichment.Http/CHANGELOG.md index 6d45de2e7e..2d92ba7f21 100644 --- a/src/OpenTelemetry.Extensions.Enrichment.Http/CHANGELOG.md +++ b/src/OpenTelemetry.Extensions.Enrichment.Http/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.2 Released 2026-Apr-23 diff --git a/src/OpenTelemetry.Extensions.Enrichment/CHANGELOG.md b/src/OpenTelemetry.Extensions.Enrichment/CHANGELOG.md index 473bd101bf..08648dd96f 100644 --- a/src/OpenTelemetry.Extensions.Enrichment/CHANGELOG.md +++ b/src/OpenTelemetry.Extensions.Enrichment/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Extensions/CHANGELOG.md b/src/OpenTelemetry.Extensions/CHANGELOG.md index fec5b818bf..36b644ad51 100644 --- a/src/OpenTelemetry.Extensions/CHANGELOG.md +++ b/src/OpenTelemetry.Extensions/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.0-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Instrumentation.AWS/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.AWS/CHANGELOG.md index 4749bae2a5..a75b729255 100644 --- a/src/OpenTelemetry.Instrumentation.AWS/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.AWS/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-18 diff --git a/src/OpenTelemetry.Instrumentation.AWSLambda/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.AWSLambda/CHANGELOG.md index 384a37cd7b..04f57ec756 100644 --- a/src/OpenTelemetry.Instrumentation.AWSLambda/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.AWSLambda/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-18 diff --git a/src/OpenTelemetry.Instrumentation.AspNet.TelemetryHttpModule/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.AspNet.TelemetryHttpModule/CHANGELOG.md index f22f35c354..1803f263a8 100644 --- a/src/OpenTelemetry.Instrumentation.AspNet.TelemetryHttpModule/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.AspNet.TelemetryHttpModule/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.AspNet/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.AspNet/CHANGELOG.md index 51f21f44c2..b15a2fbeaa 100644 --- a/src/OpenTelemetry.Instrumentation.AspNet/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.AspNet/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md index 189c7f3b47..9c12a31a17 100644 --- a/src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.Cassandra/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Cassandra/CHANGELOG.md index ebeb250f59..94467bb5b7 100644 --- a/src/OpenTelemetry.Instrumentation.Cassandra/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Cassandra/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.0.0-beta.6 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Instrumentation.ConfluentKafka/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.ConfluentKafka/CHANGELOG.md index e72b56c8b8..bc02467731 100644 --- a/src/OpenTelemetry.Instrumentation.ConfluentKafka/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.ConfluentKafka/CHANGELOG.md @@ -9,6 +9,9 @@ and producers created outside a DI container. ([#4545](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4545)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 0.1.0-alpha.7 Released 2026-May-29 diff --git a/src/OpenTelemetry.Instrumentation.ElasticsearchClient/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.ElasticsearchClient/CHANGELOG.md index 86bd7faecb..11c7ec9558 100644 --- a/src/OpenTelemetry.Instrumentation.ElasticsearchClient/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.ElasticsearchClient/CHANGELOG.md @@ -8,6 +8,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Instrumentation.EntityFrameworkCore/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.EntityFrameworkCore/CHANGELOG.md index 2d124b48f8..630362ecbe 100644 --- a/src/OpenTelemetry.Instrumentation.EntityFrameworkCore/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.EntityFrameworkCore/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.EventCounters/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.EventCounters/CHANGELOG.md index ffa4a4cc66..36187164ee 100644 --- a/src/OpenTelemetry.Instrumentation.EventCounters/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.EventCounters/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-alpha.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.GrpcCore/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.GrpcCore/CHANGELOG.md index 273cabfea6..81a25361cb 100644 --- a/src/OpenTelemetry.Instrumentation.GrpcCore/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.GrpcCore/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.0.0-beta.12 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.GrpcNetClient/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.GrpcNetClient/CHANGELOG.md index a31e747002..53ac793061 100644 --- a/src/OpenTelemetry.Instrumentation.GrpcNetClient/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.GrpcNetClient/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.Hangfire/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Hangfire/CHANGELOG.md index 1dae7949d8..6a2d279a67 100644 --- a/src/OpenTelemetry.Instrumentation.Hangfire/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Hangfire/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.Http/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Http/CHANGELOG.md index 99ab615bcf..b30d023ec5 100644 --- a/src/OpenTelemetry.Instrumentation.Http/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Http/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.Kusto/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Kusto/CHANGELOG.md index c5d56cd1f9..e98881a118 100644 --- a/src/OpenTelemetry.Instrumentation.Kusto/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Kusto/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 0.1.0-alpha.1 Released 2026-Jul-02 diff --git a/src/OpenTelemetry.Instrumentation.Owin/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Owin/CHANGELOG.md index 539efbeb67..2d5e57c2e8 100644 --- a/src/OpenTelemetry.Instrumentation.Owin/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Owin/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.Process/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Process/CHANGELOG.md index 3286bb0a11..e4c38ca7e4 100644 --- a/src/OpenTelemetry.Instrumentation.Process/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Process/CHANGELOG.md @@ -11,6 +11,9 @@ * Added the `process.windows.handle.count` metric (Windows only). * Added the `process.unix.file_descriptor.count` metric (Linux only). +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.Quartz/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Quartz/CHANGELOG.md index 9aeed2c055..80017f94ed 100644 --- a/src/OpenTelemetry.Instrumentation.Quartz/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Quartz/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Instrumentation.Remoting/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Remoting/CHANGELOG.md index 7288325574..fc7cb8362f 100644 --- a/src/OpenTelemetry.Instrumentation.Remoting/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Remoting/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 0.1.0-alpha.1 Released 2026-Jun-01 diff --git a/src/OpenTelemetry.Instrumentation.Runtime/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Runtime/CHANGELOG.md index b59d226fdb..03818281a1 100644 --- a/src/OpenTelemetry.Instrumentation.Runtime/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Runtime/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Instrumentation.ServiceFabricRemoting/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.ServiceFabricRemoting/CHANGELOG.md index 60f6d13fd2..13cf725f07 100644 --- a/src/OpenTelemetry.Instrumentation.ServiceFabricRemoting/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.ServiceFabricRemoting/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-16 diff --git a/src/OpenTelemetry.Instrumentation.SqlClient/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.SqlClient/CHANGELOG.md index f10971925c..6743860f11 100644 --- a/src/OpenTelemetry.Instrumentation.SqlClient/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.SqlClient/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.StackExchangeRedis/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.StackExchangeRedis/CHANGELOG.md index cf940b4f67..d7e09f8f03 100644 --- a/src/OpenTelemetry.Instrumentation.StackExchangeRedis/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.StackExchangeRedis/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.Instrumentation.Wcf/CHANGELOG.md b/src/OpenTelemetry.Instrumentation.Wcf/CHANGELOG.md index a0326e433d..ecd5394739 100644 --- a/src/OpenTelemetry.Instrumentation.Wcf/CHANGELOG.md +++ b/src/OpenTelemetry.Instrumentation.Wcf/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.16.0-beta.1 Released 2026-Jun-24 diff --git a/src/OpenTelemetry.OpAmp.Client/CHANGELOG.md b/src/OpenTelemetry.OpAmp.Client/CHANGELOG.md index 51bac8ca84..56b60c30bd 100644 --- a/src/OpenTelemetry.OpAmp.Client/CHANGELOG.md +++ b/src/OpenTelemetry.OpAmp.Client/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 0.5.0-alpha.1 Released 2026-Jul-01 diff --git a/src/OpenTelemetry.PersistentStorage.Abstractions/CHANGELOG.md b/src/OpenTelemetry.PersistentStorage.Abstractions/CHANGELOG.md index bfb3112d1d..3f44747df9 100644 --- a/src/OpenTelemetry.PersistentStorage.Abstractions/CHANGELOG.md +++ b/src/OpenTelemetry.PersistentStorage.Abstractions/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.1.0 Released 2026-May-05 diff --git a/src/OpenTelemetry.PersistentStorage.FileSystem/CHANGELOG.md b/src/OpenTelemetry.PersistentStorage.FileSystem/CHANGELOG.md index 4701a20f93..c48964b7e7 100644 --- a/src/OpenTelemetry.PersistentStorage.FileSystem/CHANGELOG.md +++ b/src/OpenTelemetry.PersistentStorage.FileSystem/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.1.0 Released 2026-May-05 diff --git a/src/OpenTelemetry.Resources.AWS/CHANGELOG.md b/src/OpenTelemetry.Resources.AWS/CHANGELOG.md index a94afb8d3a..2dcd837fd9 100644 --- a/src/OpenTelemetry.Resources.AWS/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.AWS/CHANGELOG.md @@ -8,6 +8,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Resources.Azure/CHANGELOG.md b/src/OpenTelemetry.Resources.Azure/CHANGELOG.md index 1c87498a3c..9c5e1b8a5b 100644 --- a/src/OpenTelemetry.Resources.Azure/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.Azure/CHANGELOG.md @@ -8,6 +8,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Resources.Container/CHANGELOG.md b/src/OpenTelemetry.Resources.Container/CHANGELOG.md index 47363a678c..21e3a5d868 100644 --- a/src/OpenTelemetry.Resources.Container/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.Container/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Resources.Gcp/CHANGELOG.md b/src/OpenTelemetry.Resources.Gcp/CHANGELOG.md index 931efd3c19..da373e46ce 100644 --- a/src/OpenTelemetry.Resources.Gcp/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.Gcp/CHANGELOG.md @@ -8,6 +8,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.0.0-alpha.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Resources.Host/CHANGELOG.md b/src/OpenTelemetry.Resources.Host/CHANGELOG.md index c72f71a057..36bd75b03e 100644 --- a/src/OpenTelemetry.Resources.Host/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.Host/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Resources.OperatingSystem/CHANGELOG.md b/src/OpenTelemetry.Resources.OperatingSystem/CHANGELOG.md index 546c510e5e..e37d1d14ef 100644 --- a/src/OpenTelemetry.Resources.OperatingSystem/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.OperatingSystem/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Resources.Process/CHANGELOG.md b/src/OpenTelemetry.Resources.Process/CHANGELOG.md index b901c95fba..c48e16f804 100644 --- a/src/OpenTelemetry.Resources.Process/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.Process/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.2 Released 2026-May-06 diff --git a/src/OpenTelemetry.Resources.ProcessRuntime/CHANGELOG.md b/src/OpenTelemetry.Resources.ProcessRuntime/CHANGELOG.md index 44a9b6c3ff..9ae86e3cb0 100644 --- a/src/OpenTelemetry.Resources.ProcessRuntime/CHANGELOG.md +++ b/src/OpenTelemetry.Resources.ProcessRuntime/CHANGELOG.md @@ -5,6 +5,9 @@ * Updated OpenTelemetry core component version(s) to `1.16.0`. ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487)) +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 1.15.1-beta.1 Released 2026-Apr-21 diff --git a/src/OpenTelemetry.Sampler.AWS/CHANGELOG.md b/src/OpenTelemetry.Sampler.AWS/CHANGELOG.md index 274c80871c..b4baa90204 100644 --- a/src/OpenTelemetry.Sampler.AWS/CHANGELOG.md +++ b/src/OpenTelemetry.Sampler.AWS/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +* Assemblies are now digitally signed using cosign. + ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637)) + ## 0.1.0-alpha.10 Released 2026-Jun-24 From 27ff690df05f7a1eb5b0f09fe7b94cb5453ba175 Mon Sep 17 00:00:00 2001 From: Martin Costello Date: Fri, 3 Jul 2026 11:42:04 +0100 Subject: [PATCH 10/11] [Infra] Update snippet Update Cosign v2 snippet copied from opentelemetry-dotnet for v3. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 257cd69d79..26b918fc70 100644 --- a/README.md +++ b/README.md @@ -172,7 +172,7 @@ cosign verify-blob \ ``` > [!NOTE] -> A successful verification outputs `Verify OK`. +> A successful verification outputs `Verified OK`. For more verification options please refer to the [cosign documentation](https://github.com/sigstore/cosign/blob/main/doc/cosign_verify-blob.md). From 2d8cf02038cafd5ced08b6cbed63cfcfbc51dd36 Mon Sep 17 00:00:00 2001 From: Martin Costello Date: Fri, 3 Jul 2026 11:42:40 +0100 Subject: [PATCH 11/11] [Infra] Fix bash syntax Remove `$` prefix to assign variables. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 26b918fc70..e870954119 100644 --- a/README.md +++ b/README.md @@ -161,8 +161,8 @@ To verify the integrity of a DLL inside a NuGet package use the Signatures use the bundle format known from cosign 3.0+. ```bash -$TAG="Instrumentation.AspNetCore-1.17.0" -$PACKAGE="OpenTelemetry.Instrumentation.AspNetCore" +TAG="Instrumentation.AspNetCore-1.17.0" +PACKAGE="OpenTelemetry.Instrumentation.AspNetCore" cosign verify-blob \ --bundle "${PACKAGE}.dll.sigstore.json" \ --certificate-identity "https://github.com/open-telemetry/opentelemetry-dotnet-contrib/.github/workflows/publish-packages.yml@refs/tags/${TAG}" \