2026-10-08 UTC
# 
Zegnat It looks like Sigstore and provenance has not landed in composer yet. Or at least not yet as of May. It was still planned as a future thing https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/