Growing the Chain: Trusting Build Provenance from Userspace

Explore the challenges and solutions for establishing trust in build provenance from userspace in this 33-minute conference talk by Billy Lynch from Chainguard. Learn how tools like Cosign, npm, and Goreleaser are enhancing package and artifact signing capabilities in CI/CD workflows. Discover the potential risks associated with generating provenance and attestations from user pipelines and understand how to build a chain of trust linking artifacts, CI configuration, and build services. Gain insights into the role of open-source technologies such as Sigstore and OIDC in enabling this trust framework. Examine what CI providers and users need to implement to establish this trust, and explore real-world examples of successful implementations for securing builds.