Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/NetRiseInc/provenance-cli/llms.txt

Use this file to discover all available pages before exploring further.

Use provenance query to interrogate individual entities in the supply chain: a specific package, the repository it comes from, a contributor’s security posture, or a published advisory.
All query subcommands accept the global flags --format (human, json, sarif), --quiet, --no-color, --ascii, and -v/-vv. See Output formats for details.

query package

Look up a package by its PURL (Package URL) to retrieve provenance data, dependency mapping, associated advisories, and contributor information. Synopsis
provenance query package <PURL> [OPTIONS]

Flags

--health
boolean
Also fetch repository health metrics for the package’s source repository — bus factor, OpenSSF Scorecard score, commit recency, signed commit ratio, and more.
Search for all known versions and architectures of the package instead of doing an exact PURL lookup. Useful when you don’t know the exact version or distro qualifier.
--dependents
boolean
Perform a reverse dependency lookup — find other packages that depend on this one.

Examples

provenance query package 'pkg:deb/debian/xz-utils@5.0.0-2?arch=amd64&distro=debian-6'
PURLs must start with pkg:. The CLI validates the format before making any API call and will return an error with a link to the PURL spec if the format is invalid.

query repo

Query a Git repository for the packages it produces, the advisories associated with it, and optionally its health metrics. Synopsis
provenance query repo <URL> [OPTIONS]

Flags

--health
boolean
Also fetch repository health metrics — OpenSSF Scorecard, bus factor, commit activity, and contributor signing data.

Examples

provenance query repo 'https://github.com/tukaani-project/xz.git'

query contributor

Look up a contributor by email address or GitHub username to see which repositories and packages they have contributed to. Synopsis
provenance query contributor <EMAIL_OR_USERNAME> [OPTIONS]
The identifier type is auto-detected: if it contains @, it is treated as an email address; otherwise it is treated as a GitHub username.

Flags

--security
boolean
Also fetch the contributor’s security posture: known data breach exposure and signing key information. Requires an email address (not a username).

Examples

provenance query contributor 'user@example.com'
--security only works with an email address. If you pass a username with --security, the CLI will emit a warning and skip the security fetch.

query advisory

Retrieve the full details of a Provenance advisory, including a description, affected packages, and associated repositories. Synopsis
provenance query advisory <ADVISORY_ID>

Example

provenance query advisory NETR-2024-0001

Build docs developers (and LLMs) love