What share of packages in long-tail have no build-provenance attestation tying the artifact to its source? · Quiet Failures

99% What share of packages in long-tail have no build-provenance attestation tying the artifact to its source?

build attested 1.09%signed, not attested 98.91%

Quiet Failures. n=275 · CC BY 4.0