99% What share of widely-used packages that build or fetch a binary at install time have no build-provenance attestation tying the artifact to its source?