artifact.whl (your package) ↓ SHA-256 a]7c3f9e... (fingerprint) ↓ anchor origin_id: ec8eead9-... (your proof) ↓ Bitcoin anchored to Bitcoin block 889,412 artifact.whl (your package) ↓ SHA-256 a]7c3f9e... (fingerprint) ↓ anchor origin_id: ec8eead9-... (your proof) ↓ Bitcoin anchored to Bitcoin block 889,412 artifact.whl (your package) ↓ SHA-256 a]7c3f9e... (fingerprint) ↓ anchor origin_id: ec8eead9-... (your proof) ↓ Bitcoin anchored to Bitcoin block 889,412 umarise anchor dist/package-1.2.0.whl umarise anchor dist/package-1.2.0.whl umarise anchor dist/package-1.2.0.whl - name: Anchor build artifact uses: AnchoringTrust/anchor-action@v1 with: file: dist/package-1.2.0.whl env: UMARISE_API_KEY: {% raw %}${{ secrets.UMARISE_API_KEY }}{% endraw %} - name: Anchor build artifact uses: AnchoringTrust/anchor-action@v1 with: file: dist/package-1.2.0.whl env: UMARISE_API_KEY: {% raw %}${{ secrets.UMARISE_API_KEY }}{% endraw %} - name: Anchor build artifact uses: AnchoringTrust/anchor-action@v1 with: file: dist/package-1.2.0.whl env: UMARISE_API_KEY: {% raw %}${{ secrets.UMARISE_API_KEY }}{% endraw %} import hashlib from umarise import UmariseCore with open("dist/package-1.2.0.whl", "rb") as f: sha256 = "sha256:" + hashlib.sha256(f.read()).hexdigest() client = UmariseCore(api_key="um_...") result = client.attest(hash_value=sha256) print(result.origin_id) import hashlib from umarise import UmariseCore with open("dist/package-1.2.0.whl", "rb") as f: sha256 = "sha256:" + hashlib.sha256(f.read()).hexdigest() client = UmariseCore(api_key="um_...") result = client.attest(hash_value=sha256) print(result.origin_id) import hashlib from umarise import UmariseCore with open("dist/package-1.2.0.whl", "rb") as f: sha256 = "sha256:" + hashlib.sha256(f.read()).hexdigest() client = UmariseCore(api_key="um_...") result = client.attest(hash_value=sha256) print(result.origin_id) Day 0: Team publishes litellm 1.52.6 (legitimate) → Without anchoring: version exists on PyPI → With anchoring: SHA-256 fingerprint anchored to Bitcoin Day 3: Attacker compromises CI vulnerability scanner → Attacker extracts PyPI credentials → Pushes malicious litellm 1.52.7 Day 4: Malicious version steals API keys from .env files → 1000+ engineers affected Day 6: Attack discovered, version yanked Day 7: Incident response begins → Without anchoring: "Our logs say we had 1.52.6" → With anchoring: "Here's the Bitcoin-anchored proof of exactly what we were running" Day 0: Team publishes litellm 1.52.6 (legitimate) → Without anchoring: version exists on PyPI → With anchoring: SHA-256 fingerprint anchored to Bitcoin Day 3: Attacker compromises CI vulnerability scanner → Attacker extracts PyPI credentials → Pushes malicious litellm 1.52.7 Day 4: Malicious version steals API keys from .env files → 1000+ engineers affected Day 6: Attack discovered, version yanked Day 7: Incident response begins → Without anchoring: "Our logs say we had 1.52.6" → With anchoring: "Here's the Bitcoin-anchored proof of exactly what we were running" Day 0: Team publishes litellm 1.52.6 (legitimate) → Without anchoring: version exists on PyPI → With anchoring: SHA-256 fingerprint anchored to Bitcoin Day 3: Attacker compromises CI vulnerability scanner → Attacker extracts PyPI credentials → Pushes malicious litellm 1.52.7 Day 4: Malicious version steals API keys from .env files → 1000+ engineers affected Day 6: Attack discovered, version yanked Day 7: Incident response begins → Without anchoring: "Our logs say we had 1.52.6" → With anchoring: "Here's the Bitcoin-anchored proof of exactly what we were running" pip install umarise umarise anchor <your-artifact> pip install umarise umarise anchor <your-artifact> pip install umarise umarise anchor <your-artifact> - Can you prove which version of a dependency you deployed last Tuesday? - If your CI provider gets compromised, does your evidence survive? - If a regulator asks for proof of what was in production, can you provide something that doesn't come from your own systems? - ML models: Can you prove which weights were in production when a decision was made? - Training data: Can you prove the dataset wasn't modified after the audit? - Docker images: Can you prove the image that ran in prod matches what was built? - Firmware: Can you prove the binary that shipped is the binary that was signed? - Umarise CLI & SDK — anchor from terminal or CI - GitHub Action — one-step anchoring in any workflow - Anchoring Specification — open standard, 18 sections - Case study: Supply chain integrity — the full LiteLLM timeline - Integration examples — MLflow, W&B, HuggingFace, S3