{
 "metric": "pkg-provenance",
 "segment": "download_tier-top100m",
 "anchor": "package",
 "label": "top100m+ (packages)",
 "population": "packages in top100m+",
 "states": [
  "attested",
  "signed_only",
  "unsigned"
 ],
 "quiet_failure_states": [
  "signed_only",
  "unsigned"
 ],
 "measurement": "Bulk npm metadata: attestations and signatures on the latest release.",
 "why_it_matters": "A signature proves the registry served what the publisher uploaded; only *provenance* links the artefact to the source commit and build that produced it. Without it, a compromised publisher account or build step is undetectable. ~85% lack provenance.",
 "limits": "**npm only.** PyPI is *excluded* rather than counted as unsigned, because its JSON API does not surface PEP 740 attestations — absence of evidence is not evidence of absence. The earlier framing (counting only `unsigned`) read 0% because npm signs everything; the real gap is build provenance, which is why `signed_only` is a failure state.",
 "data_tier": "package",
 "population_predicate": "any",
 "entity_type": "package",
 "kind": "failure",
 "latest": {
  "day": "2026-08-09",
  "n": 401,
  "qf_pct": 74.81,
  "ci": [
   70.34,
   78.81
  ],
  "dist": {
   "unsigned": 0,
   "signed_only": 74.81,
   "attested": 25.19
  },
  "snapshot": "packages-top400"
 },
 "series": [
  {
   "day": "2026-08-01",
   "n": 400,
   "qf_pct": 74.75,
   "ci": [
    70.27,
    78.76
   ],
   "dist": {
    "attested": 25.25,
    "signed_only": 74.75,
    "unsigned": 0
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-02",
   "n": 401,
   "qf_pct": 74.81,
   "ci": [
    70.34,
    78.81
   ],
   "dist": {
    "unsigned": 0,
    "signed_only": 74.81,
    "attested": 25.19
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-04",
   "n": 401,
   "qf_pct": 75.31,
   "ci": [
    70.86,
    79.28
   ],
   "dist": {
    "attested": 24.69,
    "signed_only": 75.31,
    "unsigned": 0
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-05",
   "n": 401,
   "qf_pct": 75.06,
   "ci": [
    70.6,
    79.05
   ],
   "dist": {
    "unsigned": 0,
    "signed_only": 75.06,
    "attested": 24.94
   },
   "snapshot": "packages-top400"
  },
  {
   "day": "2026-08-09",
   "n": 401,
   "qf_pct": 74.81,
   "ci": [
    70.34,
    78.81
   ],
   "dist": {
    "unsigned": 0,
    "signed_only": 74.81,
    "attested": 25.19
   },
   "snapshot": "packages-top400"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/pkg-provenance/download_tier-top100m"
}