Artifact Provenance Explorer

Verify npm build provenance: Sigstore signature, transparency log, source repo and commit.

Try an example: Pasted attestations for sigstore@3.0.0 (offline)

How it works

Fetches (or reads pasted) npm registry attestations for a package version, verifies the Sigstore bundles with node:crypto (DSSE signature, Fulcio certificate chain to the pinned Sigstore root, Rekor signed entry timestamp, Merkle inclusion proof and checkpoint), parses the SLSA provenance (builder, workflow, source repository, commit, trigger) and cross-checks it against the package metadata (repository field, gitHead, tarball integrity).

Attestations come from https://registry.npmjs.org/-/npm/v1/attestations/<name>@<version> (or your paste); package metadata from https://registry.npmjs.org/<name>/<version>.
Each Sigstore bundle is verified locally with node:crypto: the DSSE signature over the pre-authentication encoding (PAE); for provenance the Fulcio leaf certificate must chain to the pinned public-good Sigstore intermediate and root and be valid at the Rekor integratedTime; the publish attestation must be signed by a pinned npm registry key.
Transparency: the Rekor signed entry timestamp (SET) and checkpoint are verified against the pinned rekor.sigstore.dev key, the RFC 6962 Merkle inclusion proof must recompute the logged root hash, and the log entry must record the SHA-256 of this exact payload.
Cross-checks: in-toto subject = pkg:npm/<name>@<version>; subject SHA-512 = the registry tarball integrity; provenance repository = package.json repository; provenance commit = gitHead; Fulcio certificate extensions (source repository, digest, workflow) = the provenance claims.
Trust roots (npm keys, Rekor key, Fulcio certificates) are pinned snapshots from 2026-10-14, not refreshed via Sigstore TUF; rotated keys therefore show as failures, not as forgeries.

For scripts and AI agents

JSON API: POST https://artifactprovenanceexplorer.usefulweb.site/api/v1/calculate (same calculation as this page)
Interface description: OpenAPI 3.1 · AI guide: llms.txt
MCP server (Streamable HTTP): https://artifactprovenanceexplorer.usefulweb.site/mcp · tool name artifact_provenance_explorer

Example request

curl -s -X POST https://artifactprovenanceexplorer.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

Open Source Trust Explorer – Is this open-source project maintained and trustworthy? Scorecard, activity and provenance.
SBOM Explorer – Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.
Dependency Vulnerability Explorer – Known vulnerabilities in your dependencies, and the version that fixes each one.