Provetrail
Articles
GitHub
How to verify software provenance: npm, GitHub, Sigstore and SLSA
Check the signed attestation against a builder you trust, then confirm its digest matches your file. The exact commands for npm, GitHub, cosign and slsa-verifier.
provenance
supply-chain
verification