@aws-cdk/toolkit-lib — Greenflagged

AWS CDK Programmatic Toolkit Library

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

amzn-ossaws-cdk-team

Keywords

awscdk

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Large version gap in diff (v1.10→v1.25); new files are expected AWS CDK modules.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/hotswap/cloud-control-resource.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/diagnosing/tree.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/diagnosing/tree-builder.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/source-tracing/private/stack-source-tracing.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/diagnosing/stack-diagnoser.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/stack-events/resource-errors.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/orphan/orphaner.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/network-detector/network-detector.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/cloudformation/logical-id-map.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/actions/diagnose/index.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/hotswap/hotswap-template-cache.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/orphan/private/helpers.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/util/guess-language.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/util/glob-matcher.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/aws-auth/ec2-detection.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/diagnosing/early-validation.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/diagnosing/diagnosis-formatting.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/actions/deploy/private/deployment-method.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/toolkit/private/count-assembly-results.js	AI (source-diff): TypeScript compiled output with inline sourcemaps; not obfuscated.	ai	2026/05/02
source-diff	obfuscated-file:lib/api/refactoring/exclude.js	AI (source-diff): Compiled TypeScript output with readable class definitions; long lines are a false positive from TS compilation, not actual obfuscation.	ai	2026/04/22
source-diff	obfuscated-file:lib/api/notices/cached-data-source.js	AI (source-diff): Compiled TypeScript output with readable class definitions; long lines are a false positive from TS compilation, not actual obfuscation.	ai	2026/04/22
source-diff	obfuscated-file:lib/api/notices/filter.js	AI (source-diff): Compiled TypeScript output with readable class definitions; long lines are a false positive from TS compilation, not actual obfuscation.	ai	2026/04/22
source-diff	obfuscated-file:lib/util/net.js	AI (source-diff): Compiled TypeScript output with readable switch statements; long lines are a false positive from TS compilation, not actual obfuscation.	ai	2026/04/22
source-diff	obfuscated-file:lib/api/notices/notices.js	AI (source-diff): Compiled TypeScript output with readable class definitions; long lines are a false positive from TS compilation, not actual obfuscation.	ai	2026/04/22
source-diff	obfuscated-file:lib/toolkit/toolkit-error.js	AI (source-diff): Compiled TypeScript output with readable error class hierarchy; long lines are a false positive from TS compilation, not actual obfuscation.	ai	2026/04/22
source-diff	obfuscated-file:lib/api/notices/web-data-source.js	AI (source-diff): Compiled TypeScript output with readable HTTPS fetch logic; long lines are a false positive from TS compilation, not actual obfuscation.	ai	2026/04/22
semgrep	semgrep:child-process-import	AI (semgrep): Child process import is expected in a CLI toolkit for subprocess execution; legitimate pattern for npm operations.	ai	2026/04/22
phantom-deps	phantom-dep:@smithy/node-http-handler	AI (phantom-deps): Framework-scoped AWS SDK v3 Smithy package loaded by convention through middleware chain; standard for AWS SDK consumers.	ai	2026/04/22
phantom-deps	phantom-dep:@smithy/util-waiter	AI (phantom-deps): Framework-scoped AWS SDK v3 Smithy package loaded by convention through middleware chain; standard for AWS SDK consumers.	ai	2026/04/22
phantom-deps	phantom-dep:@jsii/check-node	AI (phantom-deps): Referenced in config files as part of jsii tooling conventions; not a direct import but a legitimate declared dependency for this AWS CDK package.	ai	2026/04/22
dependencies	unvetted-dep:@jsii/check-node	AI (dependencies): Known AWS CDK ecosystem package; stable dependency for this package.	ai	2026/04/22
dependencies	unvetted-dep:@aws-cdk/cli-plugin-contract	AI (dependencies): Same @aws-cdk/ org scope as the publisher (aws-cdk-team); this is a first-party AWS CDK package extracted as part of normal ecosystem modularization.	ai	2026/04/22
phantom-deps	phantom-dep:camelcase	AI (phantom-deps): Declared in dependencies and used by CLI; phantom-dep fires on indirect usage patterns common in toolkit libraries.	ai	2026/04/22
phantom-deps	phantom-dep:table	AI (phantom-deps): Declared in dependencies and used by CLI; phantom-dep fires on indirect usage patterns common in toolkit libraries.	ai	2026/04/22
phantom-deps	phantom-dep:yargs	AI (phantom-deps): Declared in dependencies and used by CLI; phantom-dep fires on indirect usage patterns common in toolkit libraries.	ai	2026/04/22
phantom-deps	phantom-dep:@aws-cdk/region-info	AI (phantom-deps): Declared in dependencies; same-org scoped package, as noted in finding.	ai	2026/04/22
phantom-deps	phantom-dep:@smithy/util-stream	AI (phantom-deps): Declared in dependencies; framework-scoped package loaded by convention, as noted in finding.	ai	2026/04/22
phantom-deps	phantom-dep:strip-ansi	AI (phantom-deps): Declared in dependencies and used by CLI; phantom-dep fires on indirect usage patterns common in toolkit libraries.	ai	2026/04/22
phantom-deps	phantom-dep:decamelize	AI (phantom-deps): Declared in dependencies and used by CLI; phantom-dep fires on indirect usage patterns common in toolkit libraries.	ai	2026/04/22
phantom-deps	phantom-dep:json-diff	AI (phantom-deps): Declared in dependencies and used by CLI; phantom-dep fires on indirect usage patterns common in toolkit libraries.	ai	2026/04/22
source-diff	obfuscated-file:lib/api/refactoring/context.js	AI (source-diff): File is readable compiled TypeScript output from the AWS CDK build pipeline, not obfuscated. Long lines are a build artifact pattern consistent with this package's other files.	ai	2026/04/22
dependencies	unvetted-peer-dep:@aws-cdk/cli-plugin-contract	AI (dependencies): Internal AWS CDK peer dependency; legitimate plugin contract for toolkit library.	ai	2026/04/22
source-diff	obfuscated-file:lib/api/refactoring/stack-definitions.js	AI (source-diff): File is compiled TypeScript with long lines, not obfuscated. Contains well-commented, readable CDK refactoring logic. False positive for this package.	ai	2026/04/22
publish-pattern	new-deps-added	AI (publish-pattern): [email protected] is an established utility; no security concerns for this package.	ai	2026/04/22
source-diff	obfuscated-file:lib/actions/refactor/private/mapping-helpers.js	AI (source-diff): Sample shows normal TypeScript transpilation, not actual obfuscation; legitimate compiled output.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): Legitimate CI/CD transition from aws-cdk-team to GitHub Actions; SLSA attestation confirms integrity.	ai	2026/04/22
dependencies	unvetted-dep:@aws-cdk/cdk-assets-lib	AI (dependencies): Internal AWS CDK dependency; ecosystem context makes this acceptable for this package.	ai	2026/04/22
phantom-deps	phantom-dep:cdk-from-cfn	AI (phantom-deps): Declared dependency referenced in config files; legitimate use case for toolkit library.	ai	2026/04/22
dependencies	unvetted-dep:cdk-assets	AI (dependencies): cdk-assets is a first-party AWS CDK package published by the same aws-cdk-team publisher. Not a third-party unvetted dependency.	ai	2026/04/22
semgrep	semgrep:env-spread	AI (semgrep): Environment variable spreading is standard practice for subprocess execution in CLI tools; no exfiltration pattern.	ai	2026/04/22
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is the documented plugin-loading pattern for AWS CDK toolkit; stable for this package.	ai	2026/04/22

Versions (showing 44 of 44)

Version	Deps	Published
1.25.0	46 / 42	2026-04-29
1.10.1	44 / 39	2025-10-22
1.10.0	44 / 39	2025-10-09
1.9.0	44 / 39	2025-10-01
1.8.3	44 / 39	2025-09-24
1.8.2	44 / 39	2025-09-17
1.8.1	44 / 39	2025-09-11
1.8.0	44 / 39	2025-09-05
1.7.0	43 / 39	2025-09-03
1.6.1	43 / 39	2025-08-27
1.6.0	43 / 39	2025-08-22
1.5.0	43 / 39	2025-08-14
1.4.1	43 / 39	2025-08-06
1.4.0	43 / 39	2025-07-29
1.3.1	43 / 39	2025-07-24
1.3.0	43 / 39	2025-07-16
1.2.4	43 / 39	2025-07-03
1.2.3	43 / 39	2025-07-02
1.2.2	43 / 39	2025-07-01
1.2.1	43 / 39	2025-06-25
1.2.0	43 / 39	2025-06-19
1.1.2	43 / 39	2025-06-18
1.1.1	43 / 39	2025-06-11
1.1.0	43 / 39	2025-06-05
1.0.0	43 / 39	2025-05-30
0.4.0	43 / 39	2025-05-28
0.3.7	46 / 38	2025-05-21
0.3.6	46 / 38	2025-05-16
0.3.5	46 / 38	2025-05-14
0.3.4	48 / 38	2025-05-08
0.3.3	54 / 33	2025-04-30
0.3.2	54 / 34	2025-04-23
0.3.1	54 / 34	2025-04-16
0.3.0	54 / 34	2025-04-16
0.2.0	54 / 34	2025-04-09
0.1.8	54 / 32	2025-04-02
0.1.7	54 / 32	2025-03-25
0.1.6	54 / 32	2025-03-19
0.1.5	54 / 33	2025-03-13
0.1.4	54 / 33	2025-03-06
0.1.3	55 / 32	2025-03-03
0.1.2	55 / 31	2025-02-26
0.1.1	54 / 31	2025-02-25
0.1.0	54 / 31	2025-02-24

v1.25.0

20 findings

HIGH New obfuscated file: lib/api/hotswap/cloud-control-resource.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/toolkit/private/count-assembly-results.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/actions/deploy/private/deployment-method.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/diagnosing/diagnosis-formatting.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/diagnosing/early-validation.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/aws-auth/ec2-detection.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/util/glob-matcher.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/util/guess-language.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/orphan/private/helpers.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/hotswap/hotswap-template-cache.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/actions/diagnose/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/cloudformation/logical-id-map.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/network-detector/network-detector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/orphan/orphaner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/stack-events/resource-errors.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/diagnosing/stack-diagnoser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/source-tracing/private/stack-source-tracing.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/diagnosing/tree-builder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/diagnosing/tree.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.10.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.10.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.9.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.8.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.8.2

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: aws-cdk-team → GitHub Actions (on 2025-09-17) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2025-09-17. This could indicate a legitimate maintainer transition or an account compromise.

v1.8.1

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: aws-cdk-team → GitHub Actions (on 2025-09-11) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2025-09-11. This could indicate a legitimate maintainer transition or an account compromise.

v1.8.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.7.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.6.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.6.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.5.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.4

8 findings

HIGH New obfuscated file: lib/api/notices/cached-data-source.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/refactoring/exclude.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/notices/filter.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/util/net.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/notices/notices.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/toolkit/toolkit-error.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/api/notices/web-data-source.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.