Observed arrival · 2026-08-22
VersionPass Makes Each Software Release Show Its Work
A trust record for a specific software version, binding its identity, artifact digests, SBOM, security state, provenance evidence, and vendor statements.
Why it surfaced
VersionPass is unusually candid about what its evidence can and cannot prove: artifact identity is verified, an SBOM is available, and build provenance is explicitly marked unavailable when absent. Buyers can inspect a live record without an account, while publishers pay to create release passports for their software.
A trust record for a specific software version, binding its identity, artifact digests, SBOM, security state, provenance evidence, and vendor statements.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue