Check C4 · provenance family · severity HIGH · automatic · one of the 22 checks
The question this check asks: is this the authentic project from its authorised source — or a fork of it, under someone else's name, that you reached by search or by recommendation?
The OpenSSF's Verify Authenticity rule says to confirm you have the authentic version from the authorised source and not a personal or attacker-controlled fork, and to reach the repository from the project's own website rather than from search results or an AI recommendation. A fork is a complete copy with one difference you cannot see from the file list: whoever owns it can add a commit. A personal fork is usually months behind and harmless. A fork with one extra commit in the build script is the classic shape of a supply-chain substitution, and its README is identical to the original's because it is the original's.
Impersonation was also part of FakeGit: the campaign's repositories borrowed the names of real projects, real AI Skills and real MCP servers so that a search — or an assistant — would surface them next to, or instead of, the genuine article. That part of the campaign is the reason this check exists, and the next-but-one section is about why it did not catch it.
C4 reads the repository's fork flag and its parent from the repository API. A fork fires at severity HIGH and costs 15 points, so a repository that trips nothing else scores 85 — the badge stays green — and the verdict reads REVIEW: the download is held, the finding names the upstream (“this is a FORK of owner/project — verify you want the fork, not upstream”), and proceeding is one click, recorded. It never blocks on its own. The evidence note in the scoring table:
“lookalike-fork risk; verify upstream”
Combined with a fresh owner account or a binary release asset the same fork is part of a BLOCK. On its own it is a prompt to open the parent and ask why you are not downloading from there.
Every legitimate fork — a maintained community fork of an abandoned project, a distribution's packaging fork, your own colleague's branch — fires this check, and there is no way for a flag to tell them from a substitution. That is why it is a warning at 15 points and not a block, and why the finding always carries the parent's name: the comparison is one click, and the decision is yours. If you download from a known fork regularly, the allowlist takes the repository or the whole owner.
Lookalike names. The check reads the fork flag. A fresh repository named one letter away from a real project, or a Skill named exactly like a genuine one under a different owner, is not a fork and does not fire. We measured this: in our Phase 0 run over all 7,648 attributed FakeGit repositories, C4 fired on none of them, because the campaign created new repositories rather than forking real ones. Name-lookalike detection is a roadmap item that this measurement produced, and this page will change when it ships. Until then the impersonation half of the campaign is caught, if at all, by the owner's account age, by the release asset, and by where the link came from.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: on the repository page, a fork says forked from owner/project directly under its name. Click through to the parent and compare the latest commits — a fork that is ahead of its upstream by one commit deserves a look at that commit. With the GitHub CLI:
gh api repos/OWNER/REPO --jq '{fork, parent: .parent.full_name, source: .source.full_name, pushed_at}'Then, per the OpenSSF rule, reach the project from its own website or its package on a registry you already trust, and download from whatever repository that links to. A search result or an assistant's answer is where you started, not where you verify.
Is a fork dangerous? Not in itself — forking is how open source works. The risk is downloading a fork when you meant the original: a personal fork that is months behind, or an attacker-controlled fork with one extra commit. That is why the check warns rather than blocks — 15 points, a REVIEW — and names the upstream so you can compare.
Does this check catch lookalike names? No, and we measured that. The check reads the repository's fork flag. A fresh repository named one letter away from a real project is not a fork, so it does not fire; in our Phase 0 measurement C4 fired on none of the 7,648 FakeGit repositories, because the campaign created new repositories rather than forking. Name-lookalike detection is on the roadmap and this page will change when it ships.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C1 Owner account age — the check that did catch the impersonating half of the campaign · C3 Star velocity and traction — stars that outrun the account, the bought-popularity variant of impersonation · C22 AI-agent provenance — when the lookalike reached you through an assistant.
Add RepoGates to Chrome Pricing
Numbers on this page: Phase 0 measurement of 2026-08-14 (7,648 attributed slugs; check mapping fixed in advance, C4 result recorded as a gap); OpenSSF Verify Authenticity; weights from the product's scoring table.