@phala/dcap-qvl

Supply chain provenance

Status for the latest visible version.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:hex-decode	AI (semgrep): Hex decoding is used to parse SGX protocol headers (SGX-TCBm) in an attestation library — entirely expected and not obfuscation.	ai	2026/04/25
semgrep	semgrep:base64-decode	AI (semgrep): Base64 decoding is used to embed a trusted root CA certificate as a constant — standard practice for certificate data in source code.	ai	2026/04/25
dependencies	unvetted-dep:elliptic	AI (dependencies): elliptic is a standard ECC library appropriate for an SGX/TDX attestation verification library that needs ECDSA signature verification.	ai	2026/04/25
phantom-deps	phantom-dep:@peculiar/asn1-x509	AI (phantom-deps): Legitimate ASN.1/X.509 parsing library declared as dependency; used for certificate handling in attestation workflows.	ai	2026/04/25
phantom-deps	phantom-dep:@peculiar/asn1-schema	AI (phantom-deps): Legitimate ASN.1 schema library declared as dependency; used for certificate/attestation data parsing.	ai	2026/04/25

Version	Deps	Published
0.4.1	8 / 0	2026-05-12
0.4.0	8 / 0	2026-01-04
0.3.9	8 / 0	2026-01-19