What share of widely-used packages that build or fetch a binary at install time have no build-provenance attestation tying the artifact to its source? · Quiet Failures

99% What share of widely-used packages that build or fetch a binary at install time have no build-provenance attestation tying the artifact to its source?

build attested 1.08%signed, not attested 98.92%

Quiet Failures. n=277 · CC BY 4.0