Signed-release evidence comes solely from OpenSSF Scorecard's Signed-Releases check, which only inspects GitHub release assets for signatures/provenance files. Packages that publish provenance to the registry instead get zero.
Observed on express-rate-limit/express-rate-limit: express-rate-limit@8.6.2 on npm carries a SLSA v1 provenance attestation and registry signatures (dist.attestations → https://registry.npmjs.org/-/npm/v1/attestations/express-rate-limit@8.6.2), yet the report says "Project has not signed or included provenance with any releases" and the project loses points twice — release_discipline (0/10) and security_posture.signed_releases (0/7.5).
npm provenance is exactly the supply-chain guarantee this component is meant to reward, and it is arguably stronger than a detached signature on a GitHub release asset. Suggested: when the primary package's registry metadata carries dist.attestations (npm) — and equivalents where other registries expose them — treat signed releases as met, independent of the Scorecard result. The registry metadata is already fetched for package resolution, so no extra call is needed for npm.
Reported by the maintainer in express-rate-limit/express-rate-limit#673: express-rate-limit/express-rate-limit#673 (comment) ("we do publish to npm with provenance").
Signed-release evidence comes solely from OpenSSF Scorecard's Signed-Releases check, which only inspects GitHub release assets for signatures/provenance files. Packages that publish provenance to the registry instead get zero.
Observed on express-rate-limit/express-rate-limit:
express-rate-limit@8.6.2on npm carries a SLSA v1 provenance attestation and registry signatures (dist.attestations→ https://registry.npmjs.org/-/npm/v1/attestations/express-rate-limit@8.6.2), yet the report says "Project has not signed or included provenance with any releases" and the project loses points twice —release_discipline(0/10) andsecurity_posture.signed_releases(0/7.5).npm provenance is exactly the supply-chain guarantee this component is meant to reward, and it is arguably stronger than a detached signature on a GitHub release asset. Suggested: when the primary package's registry metadata carries
dist.attestations(npm) — and equivalents where other registries expose them — treat signed releases as met, independent of the Scorecard result. The registry metadata is already fetched for package resolution, so no extra call is needed for npm.Reported by the maintainer in express-rate-limit/express-rate-limit#673: express-rate-limit/express-rate-limit#673 (comment) ("we do publish to npm with provenance").