ClearHash · npm:sigstore@2.3.1

   ██████╗██╗     ███████╗ █████╗ ██████╗ ██╗  ██╗ █████╗ ███████╗██╗  ██╗
  ██╔════╝██║     ██╔════╝██╔══██╗██╔══██╗██║  ██║██╔══██╗██╔════╝██║  ██║
  ██║     ██║     █████╗  ███████║██████╔╝███████║███████║███████╗███████║
  ██║     ██║     ██╔══╝  ██╔══██║██╔══██╗██╔══██║██╔══██║╚════██║██╔══██║
  ╚██████╗███████╗███████╗██║  ██║██║  ██║██║  ██║██║  ██║███████║██║  ██║
   ╚═════╝╚══════╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝

supply-chain integrity verifier — rebuild every package, compare every byte, block every tamper.

==>

clearhash info · case CLH-26

classification: open · public · MIT
subject: Supply-chain integrity (npm · PyPI · Cargo)
method: rebuild ✕ compare against attested source commit
rate-limit: 30 req/min global, /inspect endpoint

==>

inspect a package

==> examples:npm:sigstore@2.3.1 npm:@sigstore/sign npm:left-pad@1.3.0

[ OK ]attestation verifiedFulcio leaf cert · Rekor transparency-log entry · workflow URI cross-checked against source repo.

package	npm:sigstore@2.3.1
registry sha-256	1b5041a35f86125db7f872742502470753fd2e1109521b7dbff8a61d229a03c2
source repo	git+https://github.com/sigstore/sigstore-js@refs/heads/main
commit	46e7056ff9912ebfee5298d94024895a9fea76c0
builder	https://github.com/actions/runner/github-hosted
cert issuer	O=sigstore.dev, CN=sigstore-intermediate
workflow	https://github.com/sigstore/sigstore-js/.github/workflows/release.yml@refs/heads/main
rekor index	94408136

==> json · GET /api/inspect?package=npm:sigstore@2.3.1