{
 "collectedAt": "2026-10-24",
 "source": "GitHub REST API: latest stable release per repository (immutable flag, asset names, asset digests) and the attestations endpoint queried with the SHA-256 digest of the Linux amd64 archive or binary",
 "fields": {
  "immutable": "GitHub release immutability flag on the latest stable release",
  "checksums": "a checksum file or per-asset .sha256 is attached",
  "signature": "a .sig, .asc, .pem, .bundle or Sigstore bundle is attached",
  "sbom": "an SBOM asset is attached",
  "provenance_file": "an in-toto/SLSA provenance file is attached",
  "gh_attestations": "number of GitHub artifact attestations for the checked asset digest (null = no Linux amd64 asset with a digest on the release)"
 },
 "notes": [
  "helm/helm publishes binaries on get.helm.sh; the GitHub release carries signatures only",
  "Heuristic based on asset names; a project may publish signatures or provenance elsewhere"
 ],
 "repos": [
  {
   "repo": "cli/cli",
   "tag": "v2.103.2",
   "published": "2026-10-23",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 22,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "gh_2.103.2_linux_amd64.tar.gz",
   "digest": "sha256:62ccf747115ddc61237efffdde66a3c8f70ba249433dc64f70801089b59c59c8",
   "gh_attestations": 2
  },
  {
   "repo": "helm/helm",
   "tag": "v4.3.1",
   "published": "2026-10-15",
   "immutable": true,
   "immutable_last5": 4,
   "n_last": 4,
   "assets": 36,
   "checksums": true,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": null,
   "digest": null,
   "gh_attestations": null
  },
  {
   "repo": "kubernetes-sigs/kind",
   "tag": "v0.33.0",
   "published": "2026-08-26",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 10,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "kind-linux-amd64",
   "digest": "sha256:aee6151561422756b764a4ae28e7f44cda5af5a9eead3cc9985112b1de8d8e0d",
   "gh_attestations": 0
  },
  {
   "repo": "kubernetes-sigs/kustomize",
   "tag": "kustomize/v5.8.3",
   "published": "2026-10-08",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 9,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "kustomize_v5.8.3_linux_amd64.tar.gz",
   "digest": "sha256:cb9e31198d3f63b44848bd0afc4c8efc56e6cfef9c93a4a39a211940e6decd61",
   "gh_attestations": 0
  },
  {
   "repo": "derailed/k9s",
   "tag": "v0.51.0",
   "published": "2026-06-06",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 38,
   "checksums": true,
   "signature": false,
   "sbom": true,
   "provenance_file": false,
   "asset_checked": "k9s_Linux_amd64.tar.gz",
   "digest": "sha256:c3752ad51a5a4015a113819c4eeb6e55a4d0e4b8e652494797532f6fc8161dd7",
   "gh_attestations": 0
  },
  {
   "repo": "mikefarah/yq",
   "tag": "v4.54.1",
   "published": "2026-09-29",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 59,
   "checksums": true,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "yq_linux_amd64",
   "digest": "sha256:8e34fc298390875de416e6a4afcb8cabeceb25d9aa8506c1a2f9353cf702ea5f",
   "gh_attestations": 1
  },
  {
   "repo": "jqlang/jq",
   "tag": "jq-1.8.2",
   "published": "2026-06-20",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 29,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "jq-linux-amd64",
   "digest": "sha256:b1c22172dd303f3be49e935aa56aa48a8b7a46e0bc838b4997d3bb451495870f",
   "gh_attestations": 2
  },
  {
   "repo": "golangci/golangci-lint",
   "tag": "v2.15.0",
   "published": "2026-10-16",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 78,
   "checksums": true,
   "signature": false,
   "sbom": true,
   "provenance_file": false,
   "asset_checked": "golangci-lint-2.15.0-linux-amd64.tar.gz",
   "digest": "sha256:9b7fe6a6bf6334b98decf8d86b11415ea7889afdabdd1959fdce23af2a9ebcea",
   "gh_attestations": 2
  },
  {
   "repo": "goreleaser/goreleaser",
   "tag": "v2.19.0",
   "published": "2026-10-22",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 55,
   "checksums": true,
   "signature": true,
   "sbom": true,
   "provenance_file": false,
   "asset_checked": "goreleaser_Linux_x86_64.tar.gz",
   "digest": "sha256:ebc3194ad1d1b1787614405285a0039665cd4c5bd3305215a1b201600f90630b",
   "gh_attestations": 2
  },
  {
   "repo": "aquasecurity/trivy",
   "tag": "v0.76.1",
   "published": "2026-10-21",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 47,
   "checksums": true,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "trivy_0.76.1_Linux-64bit.tar.gz",
   "digest": "sha256:c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0",
   "gh_attestations": 2
  },
  {
   "repo": "sigstore/cosign",
   "tag": "v3.1.4",
   "published": "2026-10-20",
   "immutable": true,
   "immutable_last5": 1,
   "n_last": 5,
   "assets": 83,
   "checksums": true,
   "signature": true,
   "sbom": true,
   "provenance_file": false,
   "asset_checked": "cosign-linux-amd64",
   "digest": "sha256:424e2c97d0b45fd7a6b608a87f090f35633f4c23ece5f092d48bba11aaf4bbfa",
   "gh_attestations": 1
  },
  {
   "repo": "fluxcd/flux2",
   "tag": "v2.9.6",
   "published": "2026-10-01",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 17,
   "checksums": true,
   "signature": true,
   "sbom": true,
   "provenance_file": true,
   "asset_checked": "flux_2.9.6_linux_amd64.tar.gz",
   "digest": "sha256:b4d22673e9246cbd628881f1a9ef3b090085dced291e42d804555cee8e8d42c5",
   "gh_attestations": 0
  },
  {
   "repo": "argoproj/argo-cd",
   "tag": "v3.3.18",
   "published": "2026-10-22",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 4,
   "assets": 11,
   "checksums": true,
   "signature": false,
   "sbom": true,
   "provenance_file": true,
   "asset_checked": "argocd-linux-amd64",
   "digest": "sha256:949a8bd75332ee1bea47e1dd59ea991ebab5dbf0dce4c2316a07c05d8d86708b",
   "gh_attestations": 0
  },
  {
   "repo": "getsops/sops",
   "tag": "v3.13.3",
   "published": "2026-07-23",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 21,
   "checksums": true,
   "signature": true,
   "sbom": true,
   "provenance_file": true,
   "asset_checked": "sops-v3.13.3.linux.amd64",
   "digest": "sha256:e5bec3346a873ae91d871550f3e698c1aad962aff462a080e40f25fde17fef6b",
   "gh_attestations": 0
  },
  {
   "repo": "FiloSottile/age",
   "tag": "v1.3.2",
   "published": "2026-08-29",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 18,
   "checksums": false,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "age-v1.3.2-linux-amd64.tar.gz",
   "digest": "sha256:cbe24006683f8eb669266162894b9a522a1af52f2665fbc63a4bb032ed26ac10",
   "gh_attestations": 1
  },
  {
   "repo": "nektos/act",
   "tag": "v0.2.89",
   "published": "2026-06-01",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 12,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "act_Linux_x86_64.tar.gz",
   "digest": "sha256:0191d6f1f3b716b5c55820032605d05fc3c1cdbf581ebeff655019e5dd1524c0",
   "gh_attestations": 0
  },
  {
   "repo": "hadolint/hadolint",
   "tag": "v2.15.1",
   "published": "2026-07-31",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 4,
   "assets": 6,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "hadolint-linux-x86_64",
   "digest": "sha256:c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507",
   "gh_attestations": 1
  },
  {
   "repo": "koalaman/shellcheck",
   "tag": "v0.11.0",
   "published": "2025-08-04",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 13,
   "checksums": false,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "shellcheck-v0.11.0.linux.x86_64.tar.gz",
   "digest": "sha256:b7af85e41cc99489dcc21d66c6d5f3685138f06d34651e6d34b42ec6d54fe6f6",
   "gh_attestations": 0
  },
  {
   "repo": "terraform-linters/tflint",
   "tag": "v0.65.0",
   "published": "2026-10-22",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 11,
   "checksums": true,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "tflint_linux_amd64.zip",
   "digest": "sha256:d4c545ed2e29d6338604b586f34f544f380f70f243aa72f7b484713835eaec61",
   "gh_attestations": 1
  },
  {
   "repo": "rhysd/actionlint",
   "tag": "v1.7.12",
   "published": "2026-03-30",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 12,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "actionlint_1.7.12_linux_amd64.tar.gz",
   "digest": "sha256:8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8",
   "gh_attestations": 1
  },
  {
   "repo": "bufbuild/buf",
   "tag": "v1.75.0",
   "published": "2026-10-22",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 58,
   "checksums": false,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "buf-Linux-x86_64",
   "digest": "sha256:fad1e38d6909bbb583a4da81d8c02a01046e2cd663bde7e337dd24277393764b",
   "gh_attestations": 0
  },
  {
   "repo": "FiloSottile/mkcert",
   "tag": "v1.4.4",
   "published": "2022-04-26",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 7,
   "checksums": false,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "mkcert-v1.4.4-linux-amd64",
   "digest": null,
   "gh_attestations": null
  },
  {
   "repo": "smallstep/cli",
   "tag": "v0.31.0",
   "published": "2026-09-25",
   "immutable": true,
   "immutable_last5": 2,
   "n_last": 2,
   "assets": 132,
   "checksums": true,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "step_linux_amd64.tar.gz",
   "digest": "sha256:2bc654b26ca467848edb764620d6f17febea9d7d3629368b76dd20ce40c6ef32",
   "gh_attestations": 1
  },
  {
   "repo": "anchore/syft",
   "tag": "v1.55.0",
   "published": "2026-10-19",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 30,
   "checksums": true,
   "signature": true,
   "sbom": true,
   "provenance_file": false,
   "asset_checked": "syft_1.55.0_linux_amd64.tar.gz",
   "digest": "sha256:bb65249542db5fedeeb4d3f9b018b75e7264dbfbbb10486f044581a92f90490d",
   "gh_attestations": 1
  },
  {
   "repo": "anchore/grype",
   "tag": "v0.121.0",
   "published": "2026-10-19",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 17,
   "checksums": true,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "grype_0.121.0_linux_amd64.tar.gz",
   "digest": "sha256:64e07133d3486115de647a66581461dccf5c732748a0a3119077395565f15519",
   "gh_attestations": 1
  },
  {
   "repo": "gitleaks/gitleaks",
   "tag": "v8.30.1",
   "published": "2026-03-21",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 11,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "gitleaks_8.30.1_linux_x64.tar.gz",
   "digest": "sha256:551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
   "gh_attestations": 0
  },
  {
   "repo": "ko-build/ko",
   "tag": "v0.19.1",
   "published": "2026-06-29",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 26,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": true,
   "asset_checked": "ko_0.19.1_Linux_x86_64.tar.gz",
   "digest": "sha256:635ac6ea3fd376c935fee597fbb29ab2c2449f49ef1655085fe3aa9c25fed7a5",
   "gh_attestations": 0
  },
  {
   "repo": "tektoncd/cli",
   "tag": "v0.45.3",
   "published": "2026-10-23",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 16,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "tkn_0.45.3_Linux_x86_64.tar.gz",
   "digest": "sha256:2ea0cc5d20fc3a2616f4357f5c21505b8b8486c730143c79ca1552aed2a7f4be",
   "gh_attestations": 0
  },
  {
   "repo": "open-policy-agent/opa",
   "tag": "v1.21.4",
   "published": "2026-10-23",
   "immutable": true,
   "immutable_last5": 5,
   "n_last": 5,
   "assets": 16,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "opa_linux_amd64",
   "digest": "sha256:5ae411b3ae2cb093ac1f70cc20df4b372eead7be61f7de989b33a3dbd6cbe09b",
   "gh_attestations": 1
  },
  {
   "repo": "kyverno/kyverno",
   "tag": "v1.19.2",
   "published": "2026-10-20",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 2,
   "assets": 41,
   "checksums": true,
   "signature": true,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "kyverno-cli_v1.19.2_linux_x86_64.tar.gz",
   "digest": "sha256:357eaf1df8bc24ddd5a73979fadeaae6a032e8710f11af264229756e4956bf4a",
   "gh_attestations": 0
  },
  {
   "repo": "stern/stern",
   "tag": "v1.35.0",
   "published": "2026-10-22",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 10,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "stern_1.35.0_linux_amd64.tar.gz",
   "digest": "sha256:03729b01a8fcfab25f6ea53389bd38bc37400ff86d90cd2dcda541f248cf843e",
   "gh_attestations": 0
  },
  {
   "repo": "ahmetb/kubectx",
   "tag": "v0.11.0",
   "published": "2026-03-27",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 27,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "kubectx_v0.11.0_linux_x86_64.tar.gz",
   "digest": "sha256:08e031c54fbffb3f100e904e4eae94bba2730fedf4869921fda79e4d7a8f5d4c",
   "gh_attestations": 0
  },
  {
   "repo": "cert-manager/cmctl",
   "tag": "v2.6.1",
   "published": "2026-09-18",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 29,
   "checksums": true,
   "signature": true,
   "sbom": true,
   "provenance_file": false,
   "asset_checked": "cmctl_linux_amd64",
   "digest": "sha256:0af054c26a2b64ce286fa868d029164867695a93c3eb893662ce16f35e708db0",
   "gh_attestations": 0
  },
  {
   "repo": "istio/istio",
   "tag": "1.31.3",
   "published": "2026-10-22",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 4,
   "assets": 34,
   "checksums": true,
   "signature": false,
   "sbom": true,
   "provenance_file": false,
   "asset_checked": "istio-1.31.3-linux-amd64.tar.gz",
   "digest": "sha256:b32bba09bc6138d738fd19a09ef6d0fcdd5c5c013efeb72969663c24a2bddd47",
   "gh_attestations": 0
  },
  {
   "repo": "cilium/cilium-cli",
   "tag": "v0.20.1",
   "published": "2026-09-24",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 5,
   "assets": 12,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "cilium-linux-amd64.tar.gz",
   "digest": "sha256:24e817dcfcc8a12e325ce7547617bcbcf171c5b0b335bb24d2bb1207ba047f61",
   "gh_attestations": 0
  },
  {
   "repo": "ovh/ovhcloud-cli",
   "tag": "v0.16.0",
   "published": "2026-10-19",
   "immutable": true,
   "immutable_last5": 1,
   "n_last": 5,
   "assets": 10,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "ovhcloud-cli_Linux_x86_64.tar.gz",
   "digest": "sha256:527fb1c9bde0680837601e08bc064783b57eb301ab5a81fb9c1fc17f466f2898",
   "gh_attestations": 1
  },
  {
   "repo": "vmware-tanzu/velero",
   "tag": "v1.18.4",
   "published": "2026-09-28",
   "immutable": false,
   "immutable_last5": 0,
   "n_last": 2,
   "assets": 9,
   "checksums": true,
   "signature": false,
   "sbom": false,
   "provenance_file": false,
   "asset_checked": "velero-v1.18.4-linux-amd64.tar.gz",
   "digest": "sha256:e520c17d8997e1c9d0a28ae013592e4473ca3bd82cb3acd132e51286263f74bf",
   "gh_attestations": 0
  }
 ]
}