Open Source Summit North America 2025

When you buy something, you might want to know where it was assembled and where its parts came from. Depending on how thorough you are, you might want to know more details about the process. Did it meet some organic criteria? Which quality inspector assessed it? Depending on where you live in the world, you get some human readable version of that information stamped on your packaging or included on the box today.

When you consume a software artifact in production, you might want to know its *provenance*.

In this talk, we’ll explore the activity of checking provenance as a gate to production and look at questions you might want to ask. Where is this artifact from, how was it produced, what checks ran against it, who claims these facts anyways, and more. We’ll look at pre-requisites necessary to answer those kinds of questions by comparing the provenance details exposed by systems like Github Actions, Tekton Chains, and Witness.

Join us for this dive into provenance details and tools. You’ll come away with ideas on both why you should generate provenance attestations and how you can use them to do actually valuable things in the real world - not just tick a compliance checkbox.