ClearHash · npm:@sigstore/sign@5.0.0

   ██████╗██╗     ███████╗ █████╗ ██████╗ ██╗  ██╗ █████╗ ███████╗██╗  ██╗
  ██╔════╝██║     ██╔════╝██╔══██╗██╔══██╗██║  ██║██╔══██╗██╔════╝██║  ██║
  ██║     ██║     █████╗  ███████║██████╔╝███████║███████║███████╗███████║
  ██║     ██║     ██╔══╝  ██╔══██║██╔══██╗██╔══██║██╔══██║╚════██║██╔══██║
  ╚██████╗███████╗███████╗██║  ██║██║  ██║██║  ██║██║  ██║███████║██║  ██║
   ╚═════╝╚══════╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝

supply-chain integrity verifier — rebuild every package, compare every byte, block every tamper.

==>

clearhash info · case CLH-26

classification: open · public · MIT
subject: Supply-chain integrity (npm · PyPI · Cargo)
method: rebuild ✕ compare against attested source commit
rate-limit: 30 req/min global, /inspect endpoint

==>

inspect a package

==> examples:npm:sigstore@2.3.1 npm:@sigstore/sign npm:left-pad@1.3.0

[ OK ]attestation verified resolved → latestFulcio leaf cert · Rekor transparency-log entry · workflow URI cross-checked against source repo.

package	npm:@sigstore/sign@5.0.0
registry sha-256	7a8a99295b252beb75189cbafd408ceddb28b3dcc8d3625c70b2d83372604a18
source repo	git+https://github.com/sigstore/sigstore-js@refs/heads/main
commit	7d2900eca1c22b3f87c13987c8d4b7c9a29b733a
builder	https://github.com/actions/runner/github-hosted
cert issuer	O=sigstore.dev, CN=sigstore-intermediate
workflow	https://github.com/sigstore/sigstore-js/.github/workflows/release.yml@refs/heads/main
rekor index	1697019854

==> json · GET /api/inspect?package=npm:@sigstore/sign