--- title: Signing and Attestations Across Package Registries description: Package signing proves an artifact's bytes weren't tampered with, while provenance attestations record where it was built, and this survey compares both across... canonical: https://daily.dev/posts/signing-and-attestations-across-package-registries-214uwbgiy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Signing and Attestations Across Package Registries | daily.dev og:description: Package signing proves an artifact's bytes weren't tampered with, while provenance attestations record where it was built, and this survey compares both across... og:url: https://daily.dev/posts/signing-and-attestations-across-package-registries-214uwbgiy og:image: https://api.daily.dev/og/posts/214UWbGIy.png og:image:alt: Signing and Attestations Across Package Registries og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Signing and Attestations Across Package Registries **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 16 min read · 0 upvotes · 0 comments ## Summary Package signing proves an artifact's bytes weren't tampered with, while provenance attestations record where it was built, and this survey compares both across major package registries. npm, PyPI, RubyGems, JSR and crates.io now support trusted publishing, replacing long-lived API tokens with short-lived OIDC credentials from CI, making attestations easier to generate automatically. When Ultralytics was compromised in December 2024, malicious releases from the project's own workflow carried valid attestations while a later batch pushed with a leaked token had none, letting investigators tell the two apart. Maven Central still requires PGP signatures and has no trusted publishing. The Notary v1 server at notary.docker.io shuts down on December 8, 2026, with cosign and Notation named as replacements for publishers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did investigators distinguish malicious Ultralytics releases from the stolen-token uploads versus the compromised workflow uploads? The first malicious Ultralytics releases in December 2024 came from the project's own compromised release workflow and carried valid provenance attestations, while a later batch of malicious files was uploaded using a leaked API token and carried no attestations at all. That absence of an attestation let investigators separate the token-based uploads from the workflow-based releases. _Developers investigating a registry compromise can track how attestation-based forensics evolve on daily.dev._ ### Does Maven Central support trusted publishing or Sigstore attestations like npm and PyPI? No. Maven Central requires a PGP .asc signature plus MD5 and SHA-1 checksums on every published file, and has validated optional .sigstore.json files since January 2025, but an invalid one only produces a warning and Sonatype still treats PGP as the required signature. Central has no trusted publishing mechanism, so its signatures identify only the uploader's key, not the build source. _Teams deciding whether to harden Maven publishing can compare registry signing gaps on daily.dev._ ### When does Docker Content Trust shut down and what should I migrate to? The Notary v1 server backing Docker Content Trust at notary.docker.io shuts down on December 8, 2026, after Docker announced its retirement in July 2025. Cosign and Notation are named as replacements for publishers who need to keep signing images, and Docker Hardened Images already ship signed with cosign along with provenance, SBOM and VEX attestations. _Anyone planning a Docker signing migration can track deadlines like this on daily.dev._ ## Similar posts on daily.dev - [Publish a .NET package whose origin can be verified](https://daily.dev/posts/publish-a-net-package-whose-origin-can-be-verified-zmdy7xgud) · Goat Review · 3 upvotes · 0 comments - [Package managers have an integrity problem](https://daily.dev/posts/package-managers-have-an-integrity-problem-tk3f3g9tj) · Trail of Bits Blog · 1 upvotes · 0 comments - [You shouldn't trust Trusted Publishing](https://daily.dev/posts/you-shouldn-t-trust-trusted-publishing-i2wqcsici) · Lobsters · 0 upvotes · 0 comments - [Beyond container image signing: How we enforce software supply chain policies at Datadog](https://daily.dev/posts/beyond-container-image-signing-how-we-enforce-software-supply-chain-policies-at-datadog-8hb5dtlyo) · Datadog · 0 upvotes · 0 comments - [Signing is for the bad days](https://daily.dev/posts/signing-is-for-the-bad-days-x6tdcvkg1) · Andrew Nesbitt · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/signing-and-attestations-across-package-registries-214uwbgiy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Signing and Attestations Across Package Registries","url":"https://daily.dev/posts/signing-and-attestations-across-package-registries-214uwbgiy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/signing-and-attestations-across-package-registries-214uwbgiy"},"datePublished":"2026-10-30T10:42:45.515Z","dateModified":"2026-10-30T10:43:15.407Z","description":"Package signing proves an artifact's bytes weren't tampered with, while provenance attestations record where it was built, and this survey compares both across...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/signing-and-attestations-across-package-registries-214uwbgiy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,npm","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"Signing and Attestations Across Package Registries"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/signing-and-attestations-across-package-registries-214uwbgiy#faq","mainEntity":[{"@type":"Question","name":"How did investigators distinguish malicious Ultralytics releases from the stolen-token uploads versus the compromised workflow uploads?","acceptedAnswer":{"@type":"Answer","text":"The first malicious Ultralytics releases in December 2024 came from the project's own compromised release workflow and carried valid provenance attestations, while a later batch of malicious files was uploaded using a leaked API token and carried no attestations at all. That absence of an attestation let investigators separate the token-based uploads from the workflow-based releases. Developers investigating a registry compromise can track how attestation-based forensics evolve on daily.dev."}},{"@type":"Question","name":"Does Maven Central support trusted publishing or Sigstore attestations like npm and PyPI?","acceptedAnswer":{"@type":"Answer","text":"No. Maven Central requires a PGP .asc signature plus MD5 and SHA-1 checksums on every published file, and has validated optional .sigstore.json files since January 2025, but an invalid one only produces a warning and Sonatype still treats PGP as the required signature. Central has no trusted publishing mechanism, so its signatures identify only the uploader's key, not the build source. Teams deciding whether to harden Maven publishing can compare registry signing gaps on daily.dev."}},{"@type":"Question","name":"When does Docker Content Trust shut down and what should I migrate to?","acceptedAnswer":{"@type":"Answer","text":"The Notary v1 server backing Docker Content Trust at notary.docker.io shuts down on December 8, 2026, after Docker announced its retirement in July 2025. Cosign and Notation are named as replacements for publishers who need to keep signing images, and Docker Hardened Images already ship signed with cosign along with provenance, SBOM and VEX attestations. Anyone planning a Docker signing migration can track deadlines like this on daily.dev."}}]} ```