diff --git a/engine/web/src/admission/signing.jsx b/engine/web/src/admission/signing.jsx
index 1c72326..bad6457 100644
--- a/engine/web/src/admission/signing.jsx
+++ b/engine/web/src/admission/signing.jsx
@@ -191,18 +191,34 @@ function SigningRow({ r, strength: repoStrength }) {
)}
-
-
- {prov.glyph}
-
- {prov.word}
-
- {provInfo ? (
-
- {" \u{00B7} "}
- {provInfo["builder-short"]}
+ {r.provenance === "absent" ? (
+ // Almost no image ships a SLSA build-provenance attestation, so an "absent" chip would
+ // shout "no provenance" on nearly every row — pure noise. The calm default reads as a
+ // quiet muted dash (mirroring the no-signer cell); the loud chip is kept only for the
+ // meaningful states (verified / unverifiable / checking). The expandable detail still
+ // explains the absence for anyone who looks.
+
+ {"\u{2014}"}
- ) : null}
+ ) : (
+ <>
+
+
+ {prov.glyph}
+
+ {prov.word}
+
+ {provInfo ? (
+
+ {" \u{00B7} "}
+ {provInfo["builder-short"]}
+
+ ) : null}
+ >
+ )}
|
{repoStrength === "unknown" ? (
diff --git a/engine/web/test/admission.test.jsx b/engine/web/test/admission.test.jsx
index a8a2338..d08da97 100644
--- a/engine/web/test/admission.test.jsx
+++ b/engine/web/test/admission.test.jsx
@@ -85,6 +85,44 @@ describe("Admission honesty", () => {
});
});
+describe("Provenance column is quiet by default", () => {
+ // Almost no image ships a SLSA attestation, so an "absent" chip on every row is pure noise — the
+ // calm default reads as a muted dash, never the loud "no provenance" chip.
+ it("renders an ABSENT-provenance image as a muted dash, not the no-provenance chip", () => {
+ const { container } = render(
+ ,
+ );
+ const cell = container.querySelector('tr[data-signing="img-a"] .cell-provenance');
+ expect(cell).toBeTruthy();
+ expect(cell.getAttribute("data-provenance")).toBe("absent"); // still honestly tagged
+ expect(cell.querySelector(".gate-chip")).toBeNull(); // but no loud chip
+ expect(cell.textContent).not.toContain("no provenance");
+ expect(cell.textContent).toContain("—"); // a quiet dash
+ });
+
+ it("still renders the loud chip for a VERIFIED build provenance", () => {
+ const { container } = render(
+ ,
+ );
+ const cell = container.querySelector('tr[data-signing="img-a"] .cell-provenance');
+ expect(cell.querySelector(".gate-chip.prov-verified")).toBeTruthy();
+ expect(cell.textContent).toContain("org/repo");
+ });
+});
+
describe("Admission escaping", () => {
it("renders an XSS subject/image/signer identity as inert text", () => {
window.__pwned = undefined;
|