Not Just Ticking a Box - Establishing Trust in Artifacts with Provenance

Explore software artifact provenance and trust establishment in this 20-minute conference talk from the Linux Foundation's Open Source Summit. Learn why understanding where software artifacts come from and how they were produced is crucial for production environments, moving beyond mere compliance checkboxes to establish genuine trust. Discover the essential questions to ask about software provenance, including artifact origins, production processes, quality checks, and verification methods. Compare provenance details and capabilities across different systems including GitHub Actions, Tekton Chains, and Witness to understand the prerequisites for meaningful provenance verification. Gain practical insights into generating provenance attestations and implementing them for real-world value in production environments, with actionable strategies for using provenance data to make informed decisions about software artifact trustworthiness.