@cyclonedx/sign
Standalone TypeScript implementation of JSON Signature Format (JSF), JSON Signature Schema (JSS, X.590), and the JSON Canonicalization Scheme (JCS, RFC 8785). Single library covering CycloneDX 1.x (JSF) and 2.x (JSS). The only runtime dependency beyond No
4
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
sspringetteoftedalcoderpatroscyclonedx-automationjkowalleck
Keywords
cyclonedxsbomsignaturesignaturesjsfjson-signature-formatjssjson-signature-schemax590jcsrfc8785canonicalizationwebcryptobrowser
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): CycloneDX/OWASP project publishes via GitHub Actions with SLSA attestation; CI publisher is expected and verified. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64url decode is core functionality for a cryptographic signing library; not a malicious payload indicator. | ai |