GitHub now allows npm package developers to link their published packages to their source code to prove that the package was built from the source. This will help build trust and boost security.
Provenance RSS
Sigstore is a new Linux Foundation project described as "Let's Encrypt for Code Signing". The tool is developed by Google, Red Hat, and Smallstep, and is designed to offer better provenance for code.
Numerous entities from the technology and media sector such as BBC, Intel, Microsoft, and Arm have joined forces to form the Coalition for Content Provenance and Authenticity (C2PA).
