Skip to content
Rakomi Rakomi Docs

Verify our provenance

Every Rakomi JS-family SDK package is published from CI via npm Trusted Publishing (OIDC) — no long-lived tokens — and ships SLSA Build L2 provenance plus a Sigstore transparency-log (Rekor) entry. That means you don’t have to trust us: you can verify, for yourself, that the exact bytes you installed were built from the published source, in our CI, and not tampered with in transit.

The one command

Section titled “The one command”

After installing, run:

Terminal window
npm audit signatures

A healthy result looks like:

audited N packages
N packages have verified registry signatures
N packages have verified attestations

verified attestations is the important line — it means npm resolved each package’s provenance attestation, checked the signature against Sigstore’s transparency log, and confirmed the attestation’s subject digest matches the tarball you actually downloaded. If a package had been tampered with after build, this check would fail.

What is being proven

Section titled “What is being proven”
  • Build provenance (SLSA Build L2). The attestation names the builder (GitHub-hosted runner) and binds the published artifact to the workflow that produced it.
  • Subject binding. The attestation’s subject digest equals the published tarball’s integrity hash — config-match is not enough, the bytes are bound.
  • Transparency (Rekor). A public, tamper-evident inclusion proof exists for each release, so the signature cannot be repudiated or silently swapped.

Inspect it manually

Section titled “Inspect it manually”

You can also read the raw attestation for any version:

Terminal window
npm view @rakomi/node@0.1.0 dist.attestations

or query the registry attestation endpoint directly:

Terminal window
curl -s https://registry.npmjs.org/-/npm/v1/attestations/@rakomi%2fnode@0.1.0 | jq '.attestations[].predicateType'

You should see both an npm publish attestation and a https://slsa.dev/provenance/v1 predicate.

Reproducible source

Section titled “Reproducible source”

Each published version has a matching immutable, signed Git tag whose commit is the readable source the provenance points to. Advisories reference a fix as “fixed in version x.y.z” (and its tag), not a private commit diff — the published version plus its provenance is the authoritative reference.