[Infra] Digitally sign DLLs with cosign

.github/workflows/publish-packages.yml

@@ -32,8 +32,13 @@ jobs:
 
   build-pack:
     name: Build and pack
+    if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.event.repository.fork == false)
     runs-on: windows-2025
 
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      COSIGN_YES: "yes"
+
     outputs:
       artifact-url: ${{ steps.upload-artifacts.outputs.artifact-url }}
       artifact-id: ${{ steps.upload-artifacts.outputs.artifact-id }}
@@ -107,11 +112,38 @@ jobs:
       - name: dotnet test ${{ steps.resolve-project.outputs.title }}
         run: dotnet test ${env:PROJECT_PATH} --configuration Release --no-restore --no-build
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign DLLs with Cosign Keyless
+        shell: pwsh
+        run: |
+          $projectFiles = Get-ChildItem -Path src/*/*.csproj -File
+
+          foreach ($projectFile in $projectFiles) {
+              $projectName = [System.IO.Path]::GetFileNameWithoutExtension($projectFile)
+
+              $dllSearchPath = "artifacts/bin/$projectName/release*/$projectName.dll"
+
+              # Components that were not built (e.g. in tag/component
+              # builds) will not have any output, so skip them.
+              if (-not (Test-Path -Path $dllSearchPath)) {
+                  continue
+              }
+
+              Get-ChildItem -Path $dllSearchPath -File | ForEach-Object {
+                  $fileFullPath = $_.FullName
+                  Write-Output "Signing $fileFullPath"
+
+                  cosign.exe sign-blob --yes --bundle "$fileFullPath.sigstore.json" $fileFullPath
+              }
+          }
+
       - name: Create GitHub attestations for DLLs
         uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
         with:
           subject-path: |
-            ./artifacts/bin/*/release_*/OpenTelemetry*.dll
+            ./artifacts/bin/*/release*/OpenTelemetry*.dll
             !./artifacts/bin/*/**/OpenTelemetry.dll
             !./artifacts/bin/*/**/OpenTelemetry.Api.dll
             !./artifacts/bin/*/**/OpenTelemetry.Api.ProviderBuilderExtensions.dll
@@ -157,7 +189,7 @@ jobs:
   validate:
     name: Validate NuGet packages
     needs: [build-pack]
-    runs-on: ubuntu-24.04
+    runs-on: windows-2025
 
     permissions:
       attestations: read # Verify GitHub attestations for the build outputs
@@ -169,6 +201,9 @@ jobs:
         with:
           dotnet-version: ${{ needs.build-pack.outputs.dotnet-sdk-version }}
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
       - name: Install NuGet package validation tools
         env:
           # renovate: datasource=nuget depName=dotnet-validate
@@ -219,6 +254,42 @@ jobs:
             exit 1
           }
 
+      - name: Verify package DLL Cosign Keyless signatures
+        shell: pwsh
+        env:
+          CERTIFICATE_IDENTITY: "${{ github.server_url }}/${{ github.repository }}/.github/workflows/publish-packages.yml@${{ github.ref }}"
+          CERTIFICATE_OIDC_ISSUER: "https://token.actions.githubusercontent.com"
+          COSIGN_YES: "yes"
+        run: |
+          $nupkgFiles = Get-ChildItem -Path "./artifacts/*.nupkg" -File
+
+          # Copy the NuGet packages to a temporary directory and extract them
+          $tempDir = New-Item -ItemType Directory -Path (Join-Path -Path ${env:RUNNER_TEMP} -ChildPath ([System.Guid]::NewGuid().ToString()))
+          foreach ($nupkgFile in $nupkgFiles) {
+              $nupkgFilePath = $nupkgFile.FullName
+              $packageName = [System.IO.Path]::GetFileNameWithoutExtension($nupkgFilePath)
+              Write-Output "Extracting $nupkgFilePath"
+              Expand-Archive -Path $nupkgFilePath -DestinationPath (Join-Path $tempDir.FullName $packageName)
+          }
+
+          # Iterate over all DLL files in the extracted packages and verify their signatures
+          $dllFiles = Get-ChildItem -Path $tempDir.FullName -Recurse -Filter *.dll -File
+          foreach ($dllFile in $dllFiles) {
+              $dllFilePath = $dllFile.FullName
+              Write-Output "Verifying $dllFilePath"
+              cosign.exe verify-blob `
+                --bundle "$dllFilePath.sigstore.json" `
+                --certificate-identity ${env:CERTIFICATE_IDENTITY} `
+                --certificate-oidc-issuer ${env:CERTIFICATE_OIDC_ISSUER} `
+                --use-signed-timestamps `
+                $dllFilePath
+              if ($LASTEXITCODE -ne 0) {
+                  Write-Output "::error::Signature verification failed for $dllFilePath."
+                  exit 1
+              }
+              Write-Output "Signature verification succeeded for $dllFilePath"
+          }
+
       - name: Verify artifact attestations
         shell: pwsh
         env:

README.md

@@ -143,6 +143,40 @@ Nightly builds from this repo are published to [MyGet](https://www.myget.org),
 and can be installed using the
 `https://www.myget.org/F/opentelemetry/api/v3/index.json` source.
 
+## Digital signing
+
+For releases published since July 3rd 2026 the DLLs included in the packages
+pushed to NuGet are digitally signed using [Sigstore](https://www.sigstore.dev/).
+Within each NuGet package the digital signature artifacts are placed alongside
+the shipped DLL(s) in the `/lib` folder. When a project targets multiple
+frameworks each target outputs a dedicated DLL and signing artifacts into a
+sub folder based on the [TFM](https://learn.microsoft.com/dotnet/standard/frameworks).
+
+The digital signature files share the same name prefix as the DLL to ensure
+easy identification and association.
+
+To verify the integrity of a DLL inside a NuGet package use the
+[cosign](https://github.com/sigstore/cosign) tool from Sigstore.
+
+Signatures use the bundle format known from cosign 3.0+.
+
+```bash
+TAG="Instrumentation.AspNetCore-1.17.0"
+PACKAGE="OpenTelemetry.Instrumentation.AspNetCore"
+cosign verify-blob \
+    --bundle "${PACKAGE}.dll.sigstore.json" \
+    --certificate-identity "https://github.com/open-telemetry/opentelemetry-dotnet-contrib/.github/workflows/publish-packages.yml@refs/tags/${TAG}" \
+    --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+    --use-signed-timestamps \
+    "${PACKAGE}.dll"
+```
+
+> [!NOTE]
+> A successful verification outputs `Verified OK`.
+
+For more verification options please refer to the [cosign
+documentation](https://github.com/sigstore/cosign/blob/main/doc/cosign_verify-blob.md).
+
 ## Attestation
 
 Starting with the `1.14.*` releases the DLLs included in the packages pushed to

build/Common.prod.props

@@ -140,4 +140,27 @@
     <AdditionalFiles Include="$(MSBuildThisFileDirectory)/BannedSymbols.txt" />
   </ItemGroup>
 
+  <!-- This target adds any signatures found to NuGet packages -->
+  <Target Name="IncludeSigningSignaturesInPackages" BeforeTargets="_GetTargetFrameworksOutput">
+    <ItemGroup>
+      <!-- Multi-TFM layout: ...\release_net8.0\Foo.dll.sigstore.json (the * wildcard populates RecursiveDir with the config_tfm directory) -->
+      <SigstoreBundle Include="$(ArtifactsPath)\bin\$(MSBuildProjectName)\$(Configuration.ToLower())_*\$(MSBuildProjectName).dll.sigstore.json" />
+
+      <!-- Single-TFM layout: ...\release\Foo.dll.sigstore.json. This is a literal (non-wildcard) path, so it is guarded with Exists() to avoid adding a phantom item that does not exist for multi-TFM projects. -->
+      <SigstoreBundle
+          Include="$(ArtifactsPath)\bin\$(MSBuildProjectName)\$(Configuration.ToLower())\$(MSBuildProjectName).dll.sigstore.json"
+          Condition="Exists('$(ArtifactsPath)\bin\$(MSBuildProjectName)\$(Configuration.ToLower())\$(MSBuildProjectName).dll.sigstore.json')" />
+
+      <!-- RecursiveDir is e.g. `release_net8.0\` for multi-TFM (strip the slashes and the `release_` prefix to get the TFM) or empty for single-TFM (fall back to the project TFM). -->
+      <SigstoreBundle Update="@(SigstoreBundle)">
+        <TargetFramework>$([System.String]::Copy('%(RecursiveDir)').Replace('\', '').Replace('/', '').Replace('$(Configuration.ToLower())_', ''))</TargetFramework>
+      </SigstoreBundle>
+      <SigstoreBundle Update="@(SigstoreBundle)" Condition="'%(SigstoreBundle.TargetFramework)' == ''">
+        <TargetFramework>$(TargetFramework)</TargetFramework>
+      </SigstoreBundle>
+      <Content Include="@(SigstoreBundle)" Pack="True" PackagePath="lib\%(SigstoreBundle.TargetFramework)\%(Filename)%(Extension)" />
+    </ItemGroup>
+    <Message Importance="high" Text="**IncludeSignaturesInPackagesDebug** SigstoreBundles: @(SigstoreBundle->'%(Identity) => lib\%(TargetFramework)\%(Filename)%(Extension)')" />
+  </Target>
+
 </Project>

src/OpenTelemetry.Exporter.Geneva/CHANGELOG.md

@@ -15,6 +15,9 @@
   temporary arrays/strings.
   ([#4498](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4498))
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.15.2
 
 Released 2026-Apr-21

src/OpenTelemetry.Exporter.InfluxDB/CHANGELOG.md

@@ -5,6 +5,9 @@
 * Updated OpenTelemetry core component version(s) to `1.16.0`.
   ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487))
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.0.0-alpha.8
 
 Released 2026-Apr-21

src/OpenTelemetry.Exporter.OneCollector/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0
 
 Released 2026-Jun-24

src/OpenTelemetry.Extensions.AWS/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0
 
 Released 2026-Jun-18

src/OpenTelemetry.Extensions.Enrichment.AspNetCore/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.15.1-beta.2
 
 Released 2026-Apr-23

src/OpenTelemetry.Extensions.Enrichment.Http/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.15.1-beta.2
 
 Released 2026-Apr-23

src/OpenTelemetry.Extensions.Enrichment/CHANGELOG.md

@@ -5,6 +5,9 @@
 * Updated OpenTelemetry core component version(s) to `1.16.0`.
   ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487))
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.15.1-beta.1
 
 Released 2026-Apr-21

src/OpenTelemetry.Extensions/CHANGELOG.md

@@ -5,6 +5,9 @@
 * Updated OpenTelemetry core component version(s) to `1.16.0`.
   ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487))
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.15.0-beta.1
 
 Released 2026-Apr-21

src/OpenTelemetry.Instrumentation.AWS/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0
 
 Released 2026-Jun-18

src/OpenTelemetry.Instrumentation.AWSLambda/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0
 
 Released 2026-Jun-18

src/OpenTelemetry.Instrumentation.AspNet.TelemetryHttpModule/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0
 
 Released 2026-Jun-24

src/OpenTelemetry.Instrumentation.AspNet/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0
 
 Released 2026-Jun-24

src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0
 
 Released 2026-Jun-24

src/OpenTelemetry.Instrumentation.Cassandra/CHANGELOG.md

@@ -5,6 +5,9 @@
 * Updated OpenTelemetry core component version(s) to `1.16.0`.
   ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487))
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.0.0-beta.6
 
 Released 2026-Apr-21

src/OpenTelemetry.Instrumentation.ConfluentKafka/CHANGELOG.md

@@ -9,6 +9,9 @@
   and producers created outside a DI container.
   ([#4545](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4545))
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 0.1.0-alpha.7
 
 Released 2026-May-29

src/OpenTelemetry.Instrumentation.ElasticsearchClient/CHANGELOG.md

@@ -8,6 +8,9 @@
 * Updated OpenTelemetry core component version(s) to `1.16.0`.
   ([#4487](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4487))
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.15.1-beta.1
 
 Released 2026-Apr-21

src/OpenTelemetry.Instrumentation.EntityFrameworkCore/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0-beta.1
 
 Released 2026-Jun-24

src/OpenTelemetry.Instrumentation.EventCounters/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0-alpha.1
 
 Released 2026-Jun-24

src/OpenTelemetry.Instrumentation.GrpcCore/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.0.0-beta.12
 
 Released 2026-Jun-24

src/OpenTelemetry.Instrumentation.GrpcNetClient/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0-beta.1
 
 Released 2026-Jun-24

src/OpenTelemetry.Instrumentation.Hangfire/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+* Assemblies are now digitally signed using cosign.
+  ([#4637](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4637))
+
 ## 1.16.0-beta.1
 
 Released 2026-Jun-24