@owf/eudi-sca
Tools and utilities for EUDI Strong Customer Authentication per TS12
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI/CD publisher is confirmed legitimate by SLSA provenance attestation on this and likely future versions. | ai | |
| provenance | missing-githead | AI (provenance): SLSA provenance attestation provides equivalent or stronger commit linkage; missing gitHead is expected when publishing via GitHub Actions with Sigstore. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is the initial monorepo publish pattern for OWF Labs packages; not a throwaway. | ai | |
| phantom-deps | phantom-dep:@owf/mdoc | AI (phantom-deps): Same org scope workspace dep; phantom-dep heuristic unreliable for monorepo siblings. | ai | |
| phantom-deps | phantom-dep:@owf/crypto | AI (phantom-deps): Same org scope workspace dep; phantom-dep heuristic unreliable for monorepo siblings. | ai | |
| phantom-deps | phantom-dep:@sd-jwt/core | AI (phantom-deps): Referenced in config files per finding; stable false positive for this package. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 0.3.2 | 7 / 2 | |
| 0.3.1 | 7 / 2 | |
| 0.3.0 | 7 / 2 | |
| 0.2.0 | 8 / 1 | |
| 0.0.0 | 6 / 1 |
v0.3.2
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v0.3.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.