npm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem
summary
npm adds verifiable build provenance to a registry that sees ~70 billion requests/month and ~40k daily publishes, offering a public beta since April with >1,000 packages adopted and 70 flagged as high‑impact. The pipeline uses CI-issued OIDC tokens, ephemeral signing keys (private key discarded), submission to Sigstore services Fulcio and Rekor, and an npm CLI flag npm publish --provenance; the registry publishes attestations and a transparency log and the feature already integrates with OIDC-capable CI providers.
AI-written summary · about
chapters (11)
- 0:00Software provenance basics
- 5:15npm Build Providence overview
- 8:38Build Providence data flow
- 11:48Standards behind Build Providence
- 13:13Security usability expectations
- 16:22Rethinking signing paradigms
- 19:32Open build processes
- 22:23Machine identity for signing
- 24:09Providence verification
- 25:13Adopt Providence now
- 26:58Q&A
related talks
27mBringing Provenance to All of Open Source: Lessons from Npm’s Sigstore Integration
19mSecuring Packages in npm, Homebrew, PyPI, Maven Central, and...
36mWhere Does Your Software (Really) Come from?
36mSigstore: Past, Present and Future Directions
23mSecuring the npm Ecosystem
26mHow npm is Making JavaScript Safe For Everyone
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE