What should we do with the sigstore files?

[ocelotl]

I managed to use a github action to include the sigstore file in a release:

https://github.com/SecuringCarter/opentelemetry-python/releases/tag/6

Is this what we want to do with the sigstore files?

[ocelotl]

@jpkrohling

[jpkrohling]

Not quite: checking the Python docs, I would expect the sigstore file to be uncompressed under the released artifacts. Do you provide any archive with the artifacts being released? Or are those only the ones provided automatically by GitHub?

[jpkrohling]

I see now that you are signing only one file, opentelemetry-api/pyproject.toml. Would that be sufficient to reassure your users? Python itself is signed with sigstore as well, but they distribute a tgz file and sign that tgz.