Show project QR
On a published project, open Show project QR from Actions. Download PNG or SVG of the attestation URL for slide decks, packaging, or printed collateral.
Sharing from the public page
- Copy link copies the current page URL to the clipboard.
- QR code opens the same QR dialog as Show project QR, scoped to the page you're viewing.
- JSON links to the machine-readable mirror of the page (package list, licenses, JSON-LD) for buyer tooling or AI agents to read directly.
Searching and grouping packages
The default package grid lists direct dependencies first. Transitive packages sit in expandable sections under a direct parent or in Other transitive packages. Above the list, visitors can search by package name or license (including nested transitives) and turn on Group by license for per-license sections. All controls are client-side only and never change what's published.
Procurement vs. developer view
The View dropdown in the top action row switches how much technical detail each package card shows. Procurement (the default) keeps cards focused on the verdict, license, and copyright. Developer additionally shows each package's ecosystem and its registry, source, and repository URLs.
Print / Save as PDF
On the public attestation page, Print / Save as PDF opens the browser print dialog with a letter-style layout: package registry URLs, product links, and page chrome are omitted. Package names, SPDX licenses, certification, and signatures stay. To drop the page URL from the margin, uncheck Headers and footers in the print dialog.
Link previews
When someone shares an openly published attestation URL in Slack, LinkedIn, or similar, the preview card shows the project name, your organization name, and the public path. Your organization index link gets the same branded card, with your organization name and how many pages you publish. Password-protected pages do not get a personal preview card.
Publisher signatures
- Optional: Sign with the name from your account Profile and an optional title of up to 120 characters when publishing or rolling back.
- Required: Organization settings can require a signature on every publish (including rollback, which republishes).
- Signatures appear on the public page footer for that revision.
Additional page content (Settings → Attestation)
- Legal contact: an optional name and email shown as "Questions about this attestation?".
- Last-reviewed date: shows the most recent publish or signature date on the page.
- Additional disclosure notes: your own free text appended after the fixed "About this page" copy - it only adds, never replaces the fixed disclaimer.
- Distribution scope statement (Settings → Distribution): a sentence clarifying which edition this attestation covers, auto-generated from your deployment context if you don't write your own.
- Formal certification statement: either your own wording, or a built-in template filled from your company details. Certification wording is frozen at publication; the signer line is derived separately from signatures on the revision.
- AI model license section: discloses AI/ML models bundled with the product and their license terms, separate from the package inventory. See Help center → AI model disclosure (AI model disclosure).
Publish governance (Settings → Automation)
- Signature requirement: override your organization's publish-signature policy for a single project (inherit, always require, or never require).
- Re-attestation on new copyleft exposure: requires a fresh signature when a package is newly introduced with a copyleft or network flag, or when either flag changes from off to on. Packages with a known ecosystem are compared by ecosystem and name, so same-named packages from different ecosystems stay distinct. If the public page is offline and its live row has no frozen content, SourceTrust falls back to the latest permanent snapshot. Legacy snapshots without ecosystem data are matched conservatively when a name is ambiguous.
- Signature staleness: requires a fresh signature if the most recent one is older than a configured number of days.
- Setting the signature requirement to "Never require" is a hard override: it also switches off re-attestation and signature staleness for that project, so those two controls are disabled while it is set.
- Certification statement: choose the built-in SourceTrust template or your own text. With the template selected, use "See the statement" to preview the built-in template using current saved details for a future publication, and "Company details" to review and complete the organization details it uses right there in the flow. The template uses your organization's legal name; if none is set it falls back to your account name, so add the legal name for an accurate certification. Displayed signer and date details are illustrative, including unsigned previews with a fallback date; they do not predict the next revision.
Company details and multiple reviewers (organization Settings)
- Company details (Identity tab): legal name, address, contact email, website, and registration number, shown in the footer of every published page.
- Require multiple reviewers (Publishing tab): shows "Signed by N of M required reviewers" on published pages once more than one signature is expected. Informational only - it does not block publishing. Extra reviewers can add a signature to the current published revision after publish; older revisions in Publish history stay frozen.