NEW YORK — What happened
The Open Source Security Foundation (OpenSSF) has announced Sigstore 3.0, the latest major version of its open-source code signing and attestation framework. Concurrently, public package repositories npm and PyPI have initiated phased rollouts requiring published package updates from high-impact maintainers to include cryptographically verifiable build attestations generated by tools like Sigstore.
Why it matters
Supply chain attacks—where malicious actors steal developer API tokens or hijack GitHub Actions publishing workflows—have become a leading vector for malware distribution. By mandating cryptographic attestations, package managers can prove not only who published a package, but exactly which source repository, commit hash, and build environment generated the published artifact.
Deep dive
Sigstore 3.0 introduces key improvements to its ephemeral certificate authority (Fulcio) and transparency log (Rekor). Previous versions required developers or CI workflows to query transparency logs synchronously during publication, creating intermittent build failures during registry outages. Sigstore 3.0 transitions to an asynchronous, offline-verifiable tile-backed log architecture based on cryptographic Merkle tree checkpoints. This reduces build pipeline failures while providing stronger, tamper-evident verification guarantees. When a developer downloads a package via `npm install` or `pip install`, the package manager verifies that the binary package matches the cryptographic signature logged during the CI build process.
Report check
Registry maintainers claim that mandatory build attestations will eliminate automated supply chain account takeover attacks for participating packages. Security researchers verify that attestations effectively prevent malicious updates pushed via stolen API keys. However, claims that Sigstore 3.0 completely secures open-source packages against malicious code are inaccurate; attestations prove *where* a package was built, but cannot detect malicious code deliberately committed by a compromised maintainer at the source level.
Open questions
How will package registries handle emergency publishing workflows when automated CI builders fail, and will small open-source maintainers without dedicated build pipelines be locked out of publishing updates?