-
verified timestamps are provided by the SCP, so when I migrate the source to a new SCP, I think this means that the org must keep the original repo around to keep the "true" timestamps. …
-
For some ecosystems we will need to give the TRW the ability the affect the structure of the created SLSA predicate.
This is blocking SLSA v1.0 support for the Node.js builder (#2499)
This is how…
-
### New feature motivation
As [highlighted in the SLSA blog](https://slsa.dev/blog/2023/05/bringing-improved-supply-chain-security-to-the-nodejs-ecosystem), publishing projects with the npm cli wit…
travi updated
4 months ago
-
Following #768
For folks using slsa-verifier as a library, it could be useful to export the mocks we already have for the TUF client `newMockSigstoreTUFClient`, and it's implementation for `GetTar…
-
après Conversion, Filtre (contaminants) , Normalisation (quantile).
J'arrive sur imputation, Interface indique :
Err : 'x' must be an array of at least two dimensions + Err : dim(X) must have a po…
-
The SLSA attestation model [1] defines a "statement" as an in-toto attestation, e.g. as "https://in-toto.io/Statement/v1" [2]. This statement contains both the predicate (e.g. "provenance" / "cycloned…
-
https://slsa.dev/spec/v1.0/threats
One major part of this is generating "signed provenance":
https://slsa.dev/spec/v1.0/provenance
I'm not sure how this works for privately hosted `northpike`…
io7m updated
11 months ago
-
Apologies for being late to review this. It's fantastic to see the beginnings of a Source track emerge. Thank you for the continued effort on this @kpk47.
This feels equivalent to what we had in v0…
-
> you do not need to review each change to cut a release branch
This seems really tricky.
If I create a new release ref that points to the tip of main, I must ensure that the tip of…
-
The formatting for slsa v1.0 provenance was added in Chains Release [0.17.0](https://github.com/tektoncd/chains/releases/tag/v0.17.0). However, before declaring that Chains now produces SLSA v1.0 prov…