Open Source Summit India 2026

Securing software supply chains requires more than just standard formats like SBOMs or SLSA Provenance. Organizations often need custom attestations, metadata that proves how an artifact was built, what dependencies were used, and whether policies like vulnerability scans or unit tests were executed.

In this session, I will show how to extend supply chain security using open-source tools such as Cosign, InToto, and Witness to generate, ingest, and verify these custom attestations.

You’ll learn:

- How to produce attestations for builds, tests, and security checks.

- Methods to sign and verify artifacts, ensuring integrity and authenticity.

- Ways to maintain provenance and chain-of-custody for all artifacts.

- How to enforce custom compliance policies in CI/CD pipelines using OPA.

Through an end-to-end practical demo, you will gain actionable strategies to go beyond standard attestations, giving full visibility and trust in your software supply chains.