Registry
Inspect the packages before you ship.
Use the registry when you need signed component truth. Use Scan when you need a fresh object-specific audit for the actual packages in a project.
—
Curated visible
—
Blocked
—
Constrained
Checking registry evidence freshness…
The registry is a curated baseline. Upload a manifest in the dependency scan for an object-specific
live upstream audit before treating a release as current.
Curated registry, not every package.
Publicus signs reviewed trust decisions here. The dependency scan can inspect arbitrary
package files with fresh upstream evidence and marks packages outside the corpus as review gaps.
| Name | Category | Ecosystem | Status | Allowed package range | Action |
|---|---|---|---|---|---|
Selected component
Select a component
Choose a row to see status, allowed package range, advisories, project health, and signing expectations.
Freshness appears after a component loads.
Review date, projection refresh, and source sync are shown separately.
Project health
Not loaded.Select a component to inspect Scorecard context.
Signing and attestation
Not loaded.Select a component to inspect signing and attestation expectations.
Advisories
No component selected.Choose a row to inspect tracked advisories.