Bringing Provenance to Open Source - Lessons from Npm's Sigstore Integration

Explore the challenges and solutions in bringing provenance to open source software in this 27-minute conference talk by Trevor Rosen and Zach Steindler from GitHub/npm. Delve into npm's integration with Sigstore to address the lack of verifiable links between packages and their source code. Learn about the complexities of securing build processes, the implications of developer identity verification, and the potential for applying these approaches to other package ecosystems. Gain insights into one of the most significant efforts in software supply chain security and consider fundamental perspectives on package provenance across the open source landscape.