Packaging & supply chain

Building every dependency from source, signing it, and saying where it came from.

Organisation	Repos	Site	Docs	What it holds
go-pkgx	8	site	docs	A pure-Go pkgx: the package manager, the bottle installer, the bk recipe builder, and the CI factory that publishes signed bottles.
go-attest	2	site	docs	SPDX and CycloneDX SBOMs, SLSA provenance, and Ed25519 signing that is minisign- and cosign-interoperable from one keypair.
go-versions	1	site	docs	Loose, pkgx-compatible semantic versions and ranges, CalVer included.
go-gitsafe	1	site	docs	Guards on what leaves a machine: a global git hook that refuses a credential in a remote URL and a write to the branch pull requests land on, a credential helper that never lets a token reach a command line, and a scope checker that reads a token's powers without printing it.

Counts are public repositories that hold code; brand, docs and landing repositories are excluded.