Event

<p>Over the past few years, <a href="https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/">npm</a>, <a href="https://blog.pypi.org/posts/2024-11-14-pypi-now-supports-digital-attestations/">PyPI</a>, <a href="https://github.com/ruby/rubygems/pull/8239">RubyGems</a>, and <a href="https://central.sonatype.org/news/20250128_sigstore_signature_validation_via_portal/">Maven Central</a> have implemented attestations to provide build provenance: linking a package to its exact source code and build instructions. Some of these ecosystems also implemented publish/release attestations detailing exactly what files a specific version of a package should contain. These attestations are distributed as Sigstore bundles, so we'll start out by going over enough <a href="https://www.sigstore.dev/how-it-works">Sigstore</a> to understand how to verify and get the attestation information from these bundles, the APIs to get these attestations for each ecosystem, and discuss the implementation tradeoffs made by each ecosystem, as well as alternatives for non-programming language ecosystems to consider.</p>