70
%
What share of the most-downloaded packages have no build-provenance attestation tying the artifact to its source?
build attested 30.5%
signed, not attested 69.5%
Quiet Failures
.
n=400 · CC BY 4.0