Bringing Provenance to All of Open Source: Lessons from Npm’s Sigstore Integration
summary
npm ties a package back to exact commits and build instructions for the registry that serves 70 billion packages per month by adding a flag npm publish --provenance that queries GitHub Actions OIDC, creates short‑lived keys, obtains a certificate from Sigstore Fulcio and Rekor and stores in‑toto attestations. The integration uses the Salsa spec, avoids long‑lived human identity proofs, and extends npm audit to validate provenance across dependency graphs.
AI-written summary · about
chapters (6)
- 0:00NPM provenance feature
- 1:56Build provenance in open source
- 6:27NPM provenance with Sigstore
- 12:45Lessons from the project
- 17:44Getting involved in provenance
- 23:22Answering audience questions on provenance value
related talks
39mnpm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem
36mWhere Does Your Software (Really) Come from?
19mSecuring Packages in npm, Homebrew, PyPI, Maven Central, and...
30mSecuring Open Source Supply Chains
54mFrom "Trust Me" to "Verify Me"
36mSigstore: Past, Present and Future Directions
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
46mEnhancing Artifact Security with GitHub’s Build Provenance...