# Artifact Provenance Explorer

> Verify npm build provenance: Sigstore signature, transparency log, source repo and commit. Fetches (or reads pasted) npm registry attestations for a package version, verifies the Sigstore bundles with node:crypto (DSSE signature, Fulcio certificate chain to the pinned Sigstore root, Rekor signed entry timestamp, Merkle inclusion proof and checkpoint), parses the SLSA provenance (builder, workflow, source repository, commit, trigger) and cross-checks it against the package metadata (repository field, gitHead, tarball integrity).

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://artifactprovenanceexplorer.usefulweb.site/ (interactive tool at https://artifactprovenanceexplorer.usefulweb.site/tool)
- JSON API: POST https://artifactprovenanceexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://artifactprovenanceexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://artifactprovenanceexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://artifactprovenanceexplorer.usefulweb.site/mcp - tool `artifact_provenance_explorer`

## Inputs
- package (text): npm package@version - Looks up registry.npmjs.org attestations and metadata. Leave empty when pasting.
- attestations (textarea): Or paste attestations JSON - The response of /-/npm/v1/attestations/<pkg>@<version>, or a single Sigstore bundle.
- attestationsFile (file): Or upload attestations / bundle (.json)
- packageMetadata (textarea): Optional: package version metadata JSON - registry.npmjs.org/<pkg>/<version> document, used for the repository / gitHead / integrity cross-checks in paste mode.

## Method
- Attestations come from https://registry.npmjs.org/-/npm/v1/attestations/<name>@<version> (or your paste); package metadata from https://registry.npmjs.org/<name>/<version>.
- Each Sigstore bundle is verified locally with node:crypto: the DSSE signature over the pre-authentication encoding (PAE); for provenance the Fulcio leaf certificate must chain to the pinned public-good Sigstore intermediate and root and be valid at the Rekor integratedTime; the publish attestation must be signed by a pinned npm registry key.
- Transparency: the Rekor signed entry timestamp (SET) and checkpoint are verified against the pinned rekor.sigstore.dev key, the RFC 6962 Merkle inclusion proof must recompute the logged root hash, and the log entry must record the SHA-256 of this exact payload.
- Cross-checks: in-toto subject = pkg:npm/<name>@<version>; subject SHA-512 = the registry tarball integrity; provenance repository = package.json repository; provenance commit = gitHead; Fulcio certificate extensions (source repository, digest, workflow) = the provenance claims.
- Trust roots (npm keys, Rekor key, Fulcio certificates) are pinned snapshots from 2026-10-14, not refreshed via Sigstore TUF; rotated keys therefore show as failures, not as forgeries.