General guideline on binary signing

[reyang]

We don't yet have a guideline regarding how language SIGs should sign the binaries that they release.
We're seeing asks from multiple SIGs:

• OpenTelemetry.dll and OpenTelemetry.Api.dll are unsigned opentelemetry-dotnet#1302
• Introduce released package signatures opentelemetry-collector-releases#282

A possible solution would be sigstore, which is making good progress:

• https://blog.sigstore.dev/kubernetes-signals-massive-adoption-of-sigstore-for-protecting-open-source-ecosystem-73a6757da73
• https://blog.sigstore.dev/dont-panic-a-playbook-for-handling-account-compromise-with-sigstore-ee299dca5144

Additional info & ideas:

• https://www.cncf.io/blog/2022/03/10/supply-chain-security-project-in-toto-moves-to-the-cncf-incubator/

• Where to store the certificate?

  • 1Password? Add 1Password to assets community#1014
  • Github secrets for CI

• Immediate solution: Publishing hashes for binaries we distribute?

[cpanato]

let me know where i can help. :)

[reyang]

let me know where i can help. :)

@cpanato thank you! I think an OTEP would be a great starting point.

(@jsuereth FYI)