Published artifacts carry build provenance
Provenance links the published artifact back to the commit and workflow that built it, so a consumer can tell a legitimate release from one uploaded by whoever held the token.
Observable check
the exact published artifact has verifiable provenance tied to the expected repository and workflow. Prefer a registry-served record: verify npm provenance for an installed exact package version, PyPI provenance through its Integrity API, or a RubyGems attestation through its attestation API. Where a registry cannot serve provenance, verify a forge attestation for the exact published artifact and report the registry limitation; OIDC authentication alone is not provenance.
Where this comes from
- https://docs.npmjs.com/generating-provenance-statements
- https://docs.npmjs.com/trusted-publishers/
- https://docs.pypi.org/api/integrity/
- https://guides.rubygems.org/trusted-publishing/
- https://hex.pm/docs/publish
- https://guides.rubygems.org/rubygems-org-api.md
- https://github.com/hexpm/hexpm/blob/main/lib/hexpm_web/templates/docs/workload_identity.html.md
Last read against these sources on 2026-07-28.
npm confirms what provenance attests to, that npm audit signatures verifies it, and that trusted publishing generates it automatically for public packages. PyPI's Integrity API is the verification endpoint: GET /integrity/<project>/<version>/<filename>/provenance, returning attestation bundles with signatures, certificates, transparency log entries, and publisher identity, 404 when a file has no provenance. RubyGems documents GET /api/v1/attestations/[GEM NAME]-[VERSION].json, checked 2026-10-11. Hex documents Workload Identity and recorded OIDC claims, but these do not establish a signed artifact attestation. Verify an exact-artifact forge attestation where the registry cannot serve one, and report that hosting limitation. The crates.io publishing documentation was a checked negative for registry-hosted attestations on 2026-10-11. The npm and PyPI descriptions retain the verified date above.