Provenance on a package page tells you whether the package can be traced back to a source repository. A sentence such as "source repository is linked and traceable" is stronger than "no source repository on record". Neither proves the published artifact was built from that source, so verify it yourself for anything important.
What provenance means here
On a Gold package page, "Verified provenance" is one of four checklist items. The site lists complete provenance as one of its four pillars, and mentions generated SBOMs and SLSA provenance as part of its verification. The sentence under the item tells you what was actually found.
Two sentences you may see
On pages we reviewed, one package said its source repository was linked and traceable. Another said no source repository was on record, while the item title still read as verified. Always read the sentence. A missing repository link means you cannot easily check what the code does.
Why traceability matters
Registry packages are uploaded by maintainers, and the uploaded files may differ from the public source. Without a link, you cannot compare. With a link, you can at least look at the code, history and contributors.
Steps to verify a link yourself
- Open the repository from the page.
- Check the owner matches the package publisher.
- Compare the package version with a repository tag or release.
- Look at the package contents on the registry and compare file lists against the repository.
- Check whether releases come from CI rather than a personal machine, where the project says so.
Build provenance versus source linkage
These are different. Source linkage says where code lives. Build provenance, such as signed attestations, says how and where an artifact was built. Stronger provenance helps you trust the artifact, but it does not tell you the code is free of bugs. It is evidence of origin, not of quality.
When provenance is missing
Check how critical the package is. For a small dev tool, you may accept it with a note. For anything in production, prefer an alternative with a traceable source, or vendor and review the code. Raise it with your security team if the package handles secrets.
Make it routine
Safeguard policies can require a linked repository before a package enters your build, and SBOM tooling records origin data for what you ship. For a quick manifest check, use gold.safeguard.sh/scan.
Quick check
Does a linked repository prove the package is safe?
No. It lets you inspect the source. The published package can still differ from it, so compare when it matters.
Sources
- Gold Open Source directory
- Example Gold package page, linked repository
- Example Gold package page, no repository
Last reviewed: 19 October 2026.
