Where Does Your Software (Really) Come from?
summary
GitHub ships Artifact Attestations: a signing flow that binds any artifact built with Actions back to the originating repo and commit using OIDC keyless keys, sigstore bundles and in-toto/SLSA predicates. Public beta launched May 2 and just reached GA; npm provenance already records 400,000 projects and billions of downloads via the sigstore PGI. CLI verify pulls an artifact or OCI URL, checks attestations, and a Kubernetes policy controller enforces org-signed images.
AI-written summary · about
chapters (8)
- 0:00Software security needs
- 3:32GitHub’s mission to make software as safe as seafood
- 6:42Tamper-proof supply chain
- 13:22Attestations with GitHub Actions
- 19:22Open-source collaboration
- 22:54Verifying Homebrew packages
- 27:31Software provenance culture
- 28:33Q&A
related talks
46mEnhancing Artifact Security with GitHub’s Build Provenance...
39mAuthenticating Supply-chain Metadata: Building Remote Code Attestations on GitHub
54mFrom "Trust Me" to "Verify Me"
10mSource Attestations with Gitsign
20mNot Just Ticking a Box – Establishing Trust in Artifacts with Proven...
40mSigstore: How We Started, Where We Are, Where We are Headed
27mBringing Provenance to All of Open Source: Lessons from Npm’s Sigstore Integration
39mnpm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem