ClearHash · inspect

   ██████╗██╗     ███████╗ █████╗ ██████╗ ██╗  ██╗ █████╗ ███████╗██╗  ██╗
  ██╔════╝██║     ██╔════╝██╔══██╗██╔══██╗██║  ██║██╔══██╗██╔════╝██║  ██║
  ██║     ██║     █████╗  ███████║██████╔╝███████║███████║███████╗███████║
  ██║     ██║     ██╔══╝  ██╔══██║██╔══██╗██╔══██║██╔══██║╚════██║██╔══██║
  ╚██████╗███████╗███████╗██║  ██║██║  ██║██║  ██║██║  ██║███████║██║  ██║
   ╚═════╝╚══════╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝

supply-chain integrity verifier — rebuild every package, compare every byte, block every tamper.

==>

clearhash info · case CLH-26

classification: open · public · MIT
subject: Supply-chain integrity (npm · PyPI · Cargo)
method: rebuild ✕ compare against attested source commit
rate-limit: 30 req/min global, /inspect endpoint

==>

inspect a package · no rebuild, attestation parse only

Fetches the artifact, parses its SLSA attestation, validates the certificate chain. Use the CLI for the full byte-by-byte verify.

==> examples:npm:sigstore@2.3.1 npm:@sigstore/sign npm:left-pad@1.3.0