That's good but what they also want is to show whether previous versions (or the current one?) had attestation.

Maybe split Provenance into two columns? CurrentProvenance and TargetProvenance?

no, I think one column is enough. But if it was downgraded, just print something like "danger, provenance removed"

no, I think one column is enough. But if it was downgraded, just print something like "danger, provenance removed"

Whether this print information should be used when installing dependencies is determined.

as a suggestion, it'd be nice if it could show different values based on provenance coming from trusted publishing or not, like this: https://github.com/antfu-collective/taze/blob/54aeef30400423db32e7adda950ea3ecc2a9fe86/src/commands/check/render.ts#L68-L70

Yes, taze uses Anthony's proxy service, npm.antfu.dev, by default. This allows us to receive an incredibly small response size while still including the necessary provenance information. However, this does not apply to pnpm; we need to request that the npm registry add this field.

What do you think of the current solution? Should the provenance column only be displayed when trustPolicy is set to no-downgrade, or should this column be displayed by default? @zkochan