From 9031fe9f7a7fe8f7f779a2c25a28eb4efd687159 Mon Sep 17 00:00:00 2001
From: Shijie Rao <shijie.rao@openai.com>
Date: Wed, 22 Oct 2025 12:44:56 -0700
Subject: [PATCH] Add cosign signing for Linux release artifacts

---
 .github/workflows/rust-release.yml | 32 ++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index 5beadd55c4..431982239a 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -327,6 +327,38 @@ jobs:
             zstd -T0 -19 --rm "$dest/$base"
           done
 
+      - if: ${{ contains(matrix.target, 'unknown-linux') }}
+        name: Install cosign
+        uses: sigstore/cosign-installer@v3.6.0
+
+      - if: ${{ contains(matrix.target, 'unknown-linux') }}
+        name: Sign Linux artifacts
+        shell: bash
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+          COSIGN_YES: "true"
+        run: |
+          set -euo pipefail
+
+          dest="dist/${{ matrix.target }}"
+          shopt -s nullglob
+
+          for artifact in "$dest"/*; do
+            [[ -f "$artifact" ]] || continue
+
+            case "$artifact" in
+              *.sig|*.pem)
+                continue
+                ;;
+            esac
+
+            cosign sign-blob \
+              --yes \
+              --output-signature "${artifact}.sig" \
+              --output-certificate "${artifact}.pem" \
+              "$artifact"
+          done
+
       - name: Remove signing keychain
         if: ${{ always() && matrix.runner == 'macos-15-xlarge' }}
         shell: bash