Bringing Provenance to Open Source - Lessons from Npm's Sigstore Integration

This talk examines npm’s integration with Sigstore to link packages to their source code and build processes, then make that provenance verifiable through npm CLI. It also considers secure builds, developer identity, and whether the approach can work across other package ecosystems.