loglog

✓Signature on file

“Signature on file” means this version’s entry in the registry’s signed index references a signature bundle and an SLSA provenance bundle — it does not mean this site has cryptographically verified them. This site never downloads the connector binary, so it cannot confirm that the file you install today matches what was signed. That check happens when you run conduit connectors install <name>, which verifies the actual bytes against a pinned publisher identity via Sigstore and checks SLSA provenance before installing anything.

Source repository