- How to verify software provenance: npm, GitHub, Sigstore and SLSA Check the signed attestation against a builder you trust, then confirm its digest matches your file. The exact commands for npm, GitHub, cosign and slsa-verifier.
- Provenance verification: four kinds, and how each one is checked Provenance verification means checking a signed claim about where something came from or what happened to it. Content, build, data and execution provenance, side by side.
- What is verifiable execution provenance for AI agents? A portable record of what an AI agent did, in what order, under what authority, that a stranger can check. Where it sits beside C2PA, MCP, A2A and agent identity.