GIT-PKGS(1)

📦 version 0.21.0, in nixpkgs unstable

✨ NAME ✨

git-pkgs-provenance — check dependency provenance metadata. Yeah bestie, this page is straight from the Git Pkgs Manual (GIT-PKGS(1)), and it's giving “trust but verify” energy. 👑

🦋 SYNOPSIS 🦋

git-pkgs provenance [flags]

🌸 DESCRIPTION 🌸

Okay so this command checks your resolved dependencies for registry provenance and attestation metadata. It's basically doing a vibe check on whether the dependency receipts are actually receipts. 💅

It reports verified trusted-publishing signals where registry APIs expose them. It also reports registry attestations and signatures as weaker integrity signals, and it calls out unsupported ecosystems explicitly — instead of treating missing metadata as verified. No fake “it's fine” energy here, periodt. 🫶

🎀 OPTIONS 🎀

  • -b, --branch="" — Branch to query; default is the current branch. 🌿
  • -c, --commit="" — Check dependencies at a specific commit; default is HEAD. 📌
  • -e, --ecosystem="" — Filter by ecosystem. 🧚
  • -f, --format="text" — Output format: text, json; default is text. ✨
  • -h, --help[=false] — Help for provenance. 🆘
  • --missing[=false] — Only show dependencies without trusted-publishing provenance. 🙈

👑 OPTIONS INHERITED FROM PARENT COMMANDS 👑

  • --color="auto" — When to colorize output: auto, always, never; default is auto. 🌈
  • --include-submodules[=false] — Include git submodules when scanning for manifests. 🧩
  • -p, --pager[=false] — Use pager for output. 📜
  • -q, --quiet[=false] — Suppress non-essential output. 🤫

🌟 SEE ALSO 🌟

💜 HISTORY 💜

28-Oct-2026 — Auto generated by spf13/cobra. Cute little automation moment, ngl. 🎀

💖 source/version git-pkgs, dated Oct 2026 — that's the footer energy, bestie. mwah 🫶

📦 where this page comes from