← Home

@k13engineering/linux-dmabuf-allocator

npm Repository Homepage

Linux dmabuf allocator module

6
Versions
LGPL 2.1
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

simon.kadisch

Keywords

nodedmabuflinuxallocator

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
license uncommon-license:LGPL 2.1 AI (license): LGPL 2.1 is a well-known copyleft license; stable for this package. ai
bogus-package bogus-package AI (bogus-package): Early-stage native Linux binding; empty dist and sparse README are expected for v0.0.x releases, not spam indicators. ai
phantom-deps phantom-dep:syscall-napi AI (phantom-deps): Native binding package; syscall-napi may be used indirectly via native addon, not a direct JS import. ai
phantom-deps phantom-dep:@k13engineering/po6-ioctl AI (phantom-deps): Same-org dependency for ioctl binding; phantom-dep heuristic unreliable for native/ESM packages. ai

Versions (showing 6 of 6)

Version Deps Published
0.1.0 1 / 0
0.0.5 2 / 0
0.0.4 2 / 0
0.0.3 2 / 0
0.0.2 2 / 0
0.0.1 2 / 0

v0.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.