@justeattakeaway/pie-tag
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Consistent across all versions of this package; org-wide pattern, not a per-version concern. | ai |
Versions (showing 51 of 60)
| Version | Deps | Published |
|---|---|---|
| 1.0.0 | 1 / 5 | |
| 0.22.26 | 1 / 5 | |
| 0.22.25 | 1 / 5 | |
| 0.22.24 | 1 / 5 | |
| 0.22.23 | 1 / 5 | |
| 0.22.22 | 1 / 5 | |
| 0.22.21 | 1 / 5 | |
| 0.22.20 | 1 / 5 | |
| 0.22.19 | 1 / 5 | |
| 0.22.18 | 1 / 7 | |
| 0.22.17 | 1 / 7 | |
| 0.22.16 | 1 / 7 | |
| 0.22.15 | 1 / 7 | |
| 0.22.14 | 1 / 7 | |
| 0.22.13 | 1 / 7 | |
| 0.22.12 | 1 / 7 | |
| 0.22.11 | 1 / 7 | |
| 0.22.10 | 1 / 7 | |
| 0.22.9 | 1 / 7 | |
| 0.22.8 | 1 / 7 | |
| 0.22.7 | 1 / 7 | |
| 0.22.6 | 1 / 7 | |
| 0.22.5 | 1 / 7 | |
| 0.22.4 | 1 / 7 | |
| 0.22.3 | 1 / 7 | |
| 0.22.2 | 1 / 7 | |
| 0.22.1 | 1 / 7 | |
| 0.22.0 | 1 / 7 | |
| 0.21.4 | 1 / 7 | |
| 0.21.3 | 1 / 7 | |
| 0.21.2 | 1 / 7 | |
| 0.21.1 | 1 / 7 | |
| 0.21.0 | 1 / 7 | |
| 0.20.0 | 1 / 7 | |
| 0.19.0 | 1 / 7 | |
| 0.18.0 | 1 / 7 | |
| 0.17.5 | 1 / 7 | |
| 0.17.4 | 1 / 7 | |
| 0.17.3 | 1 / 7 | |
| 0.17.2 | 1 / 7 | |
| 0.17.1 | 1 / 7 | |
| 0.17.0 | 1 / 7 | |
| 0.16.1 | 1 / 7 | |
| 0.16.0 | 1 / 7 | |
| 0.15.0 | 1 / 6 | |
| 0.14.1 | 1 / 6 | |
| 0.14.0 | 1 / 6 | |
| 0.13.0 | 1 / 6 | |
| 0.12.0 | 1 / 6 | |
| 0.11.1 | 1 / 6 | |
| 0.11.0 | 1 / 6 |
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.