NEW YORK — What happened
The Open Source Security Foundation (OpenSSF), alongside maintainers from PyPI, npm, and Cargo, announced widespread deployment of automated cryptographic build attestations. Using the updated SPDX 3.0 specification and Sigstore, package registries now generate tamper-evident signatures every time a maintainer publishes an open-source library from a verified source repository.
Why it matters
Supply chain attacks, where malicious actors hijack popular software packages or compromise developer accounts to insert backdoors, remain a primary threat to modern software development. By automating cryptographic signatures, developer tools can verify that the code downloaded from a package manager matches the source code published on GitHub or GitLab before it runs on a build server.
Deep dive
The new workflow removes manual key management for library authors. When code is built inside a continuous integration (CI) runner, Sigstore generates a short-lived cryptographic key paired with an identity token. The resulting attestation explicitly links the published software binary or script directly to the specific git commit and build pipeline. When a developer runs `npm install` or `cargo add`, the package manager checks the registry's public ledger to confirm authenticity.
Report check (claims vs what is verified vs still rumor)
OpenSSF claims that over 40% of the top 10,000 open-source packages across PyPI and npm now ship with verifiable build attestations. Independent scanning verifies that automated signatures are active for major frameworks, though legacy packages published prior to mid-2025 remain unsigned unless updated by their maintainers.
Open questions
How will package managers handle builds originating from private or self-hosted CI pipelines without compromising private operational data? Will developer build tools eventually block unsigned packages by default?