Verify this data

Every file in the report data is published by one GitHub Actions workflow and covered by a GitHub artifact attestation: a Sigstore-signed statement, recorded in the public Rekor transparency log, that names the exact file digest, the workflow file, the commit it ran at, and the run.

Check it yourself

Requires git, sha256sum, and the GitHub CLI.

git clone https://github.com/rezmoss/awesome-security-pipeline.git source
git clone --branch supply-chain-data https://github.com/rezmoss/awesome-security-pipeline.git report-data
cd report-data
gh attestation verify SHA256SUMS --repo rezmoss/awesome-security-pipeline --signer-workflow rezmoss/awesome-security-pipeline/.github/workflows/supply-chain-report.yml
sha256sum -c SHA256SUMS        # macOS: shasum -a 256 -c SHA256SUMS
# append-only history, recomputation, and release anchors:
python3 ../source/scripts/supply_chain_scan.py verify --data-dir . --history --attestations

Any single file can also be checked on its own, for example one project's JSON downloaded from this site:

gh attestation verify projects/gitleaks__gitleaks.json --repo rezmoss/awesome-security-pipeline --signer-workflow rezmoss/awesome-security-pipeline/.github/workflows/supply-chain-report.yml

Raw SBOMs, Grype, OSV-Scanner, and govulncheck output for each week are attached to an immutable GitHub release with their own attestation:

gh release download report-2026-11-02 --repo rezmoss/awesome-security-pipeline
gh attestation verify supply-chain-evidence-*.tar.gz --repo rezmoss/awesome-security-pipeline --signer-workflow rezmoss/awesome-security-pipeline/.github/workflows/supply-chain-report.yml

What a successful check proves

• The bytes you have were produced by .github/workflows/supply-chain-report.yml in rezmoss/awesome-security-pipeline, at the commit and run named in the attestation. The commit is public, so the code that produced the data can be read.
• The files were not changed after that run: any edit changes the digest and the check fails.
• verify --history shows the data branch was only appended to: earlier weeks were never rewritten, and a replaced run for the same week is kept under runs/superseded/.

What it does not prove

• That the scanners are right. Results are what Syft, Grype, OSV-Scanner, govulncheck, zizmor, and Scorecard reported; their databases and the OpenSSF dataset are outside this repository's control.
• That the workflow is correct or neutral. It proves which code ran, not that the code is good; review the commit.
• Anything about weeks published before 2026-11-08, which predate attestation. Their content is still covered by the history check and by later attestations of the whole data tree.
• That the repository owner cannot publish new data. The owner controls the workflow; every change to it is a public commit, and manual interventions are listed on the corrections page.

Scan environment for 2026-11-02

Exploitation data

Downloaded 2026-11-02T01:30 UTC by a read-only job; both files are in the evidence release.