← Home

@libp2p/webtransport

npm Repository Homepage
32
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

daviddiasalanshawachingbrainvascosantosnpm-service-account-libp2pjacobheun

Keywords

IPFS

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@libp2p/noise AI (dependencies): @libp2p/noise is a first-party libp2p org package; same trusted publisher ecosystem. ai
provenance publisher-changed AI (provenance): Transition from achingbrain to GitHub Actions CI publishing is consistent with monorepo CI migration; SLSA attestation confirms integrity. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy explained by monorepo restructuring; SLSA provenance attestation confirms legitimate CI publish. ai

Versions (showing 32 of 32)

Version Deps Published
6.0.32 11 / 12
6.0.31 11 / 12
6.0.30 11 / 12
6.0.29 11 / 13
6.0.28 11 / 13
6.0.27 11 / 13
6.0.26 11 / 13
6.0.25 11 / 13
6.0.24 11 / 13
6.0.23 11 / 13
6.0.22 11 / 13
6.0.21 11 / 13
6.0.20 11 / 13
6.0.19 11 / 13
6.0.17 11 / 13
6.0.16 11 / 13
6.0.15 11 / 13
6.0.14 11 / 13
6.0.13 11 / 13
6.0.12 11 / 13
6.0.11 11 / 13
6.0.10 11 / 13
6.0.9 11 / 13
6.0.8 11 / 13
6.0.7 11 / 13
6.0.6 11 / 13
6.0.5 11 / 13
6.0.4 11 / 13
6.0.3 11 / 13
6.0.2 11 / 13
6.0.1 11 / 13
6.0.0 11 / 13

v6.0.32

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.31

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.