Unverified50% confidenceFactExact time
The release commit carries a GPG signature, which together with the npm provenance mechanism makes the package origin traceable, allowing users to verify that the installed package was produced by that repository's CI.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedGPG signature verification is a standard method used in open-source software release processes to confirm the authenticity of artifacts, and can effectively guard against supply chain attacks.78% similarUnverifiedDevelopers can verify the signature integrity of packages via the npm audit signatures command.69% similarUnverifiedThe project proposes a contract-grade verifier specifically designed to verify the correctness of GPU kernel code generated by large language models67% similarUnverifiedThe core mechanism of remote attestation is: when the enclave starts, the hardware generates a quote containing the code measurement and a certificate chain signed with the vendor's private key, and the verifier checks the signature against the vendor root certificate and compares the measurement.64% similarUnverifiedSourcey's creators disclose that they discovered the registry while completing a paid bounty task that required citing it from the relevant public pages; all technical claims were verified against live endpoints before writing.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1071055API
curl https://kongchang.com/api/v1/knowledge/claims/1071055MCP
get_claim(id=1071055)