NEW YORK — What happened
The Open Source Security Foundation (OpenSSF), in partnership with major language registries including npm and PyPI, published a joint telemetry report detailing the impact of mandatory keyless provenance signing. Twelve months after key registries required publishing pipelines to attach cryptographic provenance signatures via tools like Sigstore, malicious account takeover incidents resulting in backdoored releases dropped by 62% across monitored ecosystems.
Why it matters
Software supply chain attacks have emerged as one of the most severe vectors in cybersecurity, where attackers hijack developer accounts or CI/CD pipelines to inject malware into common libraries. Traditional PGP key management failed because developers often lost private keys, reused them across insecure devices, or failed to rotate them. Keyless cryptographic signing ties package verification to identity providers via OpenID Connect (OIDC), ensuring verifiable provenance without permanent cryptographic secrets lingering on developer laptops.
Deep dive
The infrastructure works by generating ephemeral cryptographic key pairs inside automated build environments (such as GitHub Actions or GitLab CI). The build system presents an OIDC token validating that the code was built from a specific repository commit. The certificate authority issues a certificate valid for only minutes, logs the transaction to an append-only transparency log (Rekor), and attaches this metadata to the uploaded package. Downstream package managers then check the log to verify that the binary directly matches the declared source repository before installing.
Report check
Some security vendors claimed this completely halts supply chain compromises. That is demonstrably false. The report explicitly clarifies that keyless signing protects package *integrity* and *provenance*—meaning it verifies where the software came from—but does not stop malicious source code intentionally authored by a legitimate maintainer or committed after a source-repository compromise.
Open questions
How will registries handle self-hosted and independent open-source developers who do not utilize centralized cloud CI providers for automated OIDC issuance?