70
%
What share of packages in top100m+ have no build-provenance attestation tying the artifact to its source?
build attested 30.42%
signed, not attested 69.58%
Quiet Failures
.
n=401 · CC BY 4.0