Unverified50% confidenceFactExact time
GitHub attestation allows users to verify, through commands such as gh attestation verify, that a certain npm package was indeed built from the specified repository and commit.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedGitHub trusted signing (Sigstore/GitHub Attestations) verifies the provenance of release artifacts through cryptographic endorsement, serving as a means of strengthening npm supply chain security.79% similarUnverifiedGitHub automatically attaches a verified signature to commits created through its web interface or specific integrations, and displays a 'Verified' badge in the interface.76% similarUnverifiedGitHub's Trusted Publishing combined with GPG signing mechanisms can prove that a given npm package was indeed published by the CI/CD pipeline of a specific repository.76% similarUnverifiedThe commit was signed by project maintainer jmorganca and released with a verified signature through GitHub.73% similarVerifiedThis release record was completed by a GitHub Actions automated workflow and carries an official GitHub verified signature (Verified).70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1023757API
curl https://kongchang.com/api/v1/knowledge/claims/1023757MCP
get_claim(id=1023757)