← Home

projen

npm Repository Homepage
100
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

amzn-ossprojen-automation

Keywords

cdkcicdgeneratormanagementprojectscaffolding

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
vendored-integrity unresolved-vendored-tree:node_modules/@iarna/toml AI (vendored-integrity): Declared bundledDependency; version-hash mismatch not implant evidence. ai
vendored-integrity unresolved-vendored-tree:node_modules/undici-types AI (vendored-integrity): Common @types/node transitive artifact, unchanged from prior approved version. ai
vendored-integrity unresolved-vendored-tree:node_modules/just-diff-apply AI (vendored-integrity): Transitive dep, unchanged from prior approved version. ai
vendored-integrity unresolved-vendored-tree:node_modules/has-own-prop AI (vendored-integrity): Transitive dep of bundled tooling; no diff vs prior approved version. ai
vendored-integrity unresolved-vendored-tree:node_modules/yargs AI (vendored-integrity): Bundled dependency declared in package.json; version mismatch only. ai
vendored-integrity unresolved-vendored-tree:node_modules/xregexp AI (vendored-integrity): Common transitive dep, unindexed version mismatch. ai
vendored-integrity unresolved-vendored-tree:node_modules/which-module AI (vendored-integrity): Common transitive dep, unindexed version mismatch. ai
vendored-integrity unresolved-vendored-tree:node_modules/core-js-pure AI (vendored-integrity): Transitive dep pulled via bundled deps; unindexed version, not an implant. ai
vendored-integrity unresolved-vendored-tree:node_modules/ansi-regex AI (vendored-integrity): Common transitive dep, unindexed version mismatch. ai
vendored-integrity unresolved-vendored-tree:node_modules/@babel/runtime-corejs3 AI (vendored-integrity): Transitive dep pulled via bundled deps; unindexed version, not an implant. ai
vendored-integrity unresolved-vendored-tree:node_modules/yargs/node_modules/decamelize AI (vendored-integrity): Nested transitive dep, unindexed version. ai
vendored-integrity unresolved-vendored-tree:node_modules/y18n AI (vendored-integrity): Common transitive dep, unindexed version mismatch. ai
vendored-integrity unresolved-vendored-tree:node_modules/yargs-parser AI (vendored-integrity): Nested transitive dep, unindexed version. ai
vendored-integrity unresolved-vendored-tree:node_modules/@babel/runtime AI (vendored-integrity): Common transitive toolchain dep; byte mismatch likely unindexed version, not implant. ai
vendored-integrity unresolved-vendored-tree:node_modules/yaml AI (vendored-integrity): yaml is a declared bundledDependency; expected vendoring, not a hidden payload. ai
source-diff obfuscated-file:lib/util/task-env.js AI (source-diff): Readable commented helper module; long-line heuristic false positive. ai
source-diff obfuscated-file:lib/release/apply-version-bump.task.js AI (source-diff): Readable commented CJS build output of release bump task; long-line heuristic false positive. ai
source-diff obfuscated-file:lib/javascript/pnpm-workspace-config.js AI (source-diff): jsii/json2jsii-generated schema serializer; long lines are codegen, not obfuscation. ai
source-diff obfuscated-file:lib/util/exec.js AI (source-diff): TSC-compiled ESM helpers, not obfuscation; stable build output. ai
source-diff obfuscated-file:lib/task-shell.js AI (source-diff): Compiled jsii class, legible source. ai
source-diff obfuscated-file:lib/typescript/typescript-runner.js AI (source-diff): Compiled jsii class, legible source. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get in documented proxy-binding helper. ai
source-diff obfuscated-file:lib/cli/cmds/synth.js AI (source-diff): Standard tsc CJS output. ai
source-diff encoded-string-file:lib/run-task.cjs AI (source-diff): Bundled task runner (esbuild); long strings are build artifacts. ai
source-diff obfuscated-file:lib/cli/cmds/run-task.js AI (source-diff): TS-compiler emitted CJS; long lines are helper preamble, not obfuscation. ai
semgrep semgrep:env-bulk-read AI (semgrep): getRealEnvVars in task runner; expected for a CLI. ai
source-diff obfuscated-file:lib/task-runner.js AI (source-diff): projen's own compiled task runner, tsc output not obfuscation. ai
source-diff obfuscated-file:lib/cli/task-runtime.js AI (source-diff): Compiled task runtime, tsc output. ai
source-diff net-exec-file:node_modules/dax/script/mod.js AI (source-diff): dax is a shell-execution library; network+exec patterns are its core functionality. ai
source-diff obfuscated-file:node_modules/dax/esm/mod.js AI (source-diff): Bundled transpiled output from dax (Deno-to-Node build); not obfuscated. ai
source-diff obfuscated-file:node_modules/dax/script/mod.js AI (source-diff): Bundled transpiled output from dax (Deno-to-Node build); not obfuscated. ai
source-diff net-exec-file:node_modules/dax/esm/mod.js AI (source-diff): dax is a shell-execution library; network+exec patterns are its core functionality. ai
source-diff obfuscated-file:lib/cdk/jsii-build.js AI (source-diff): jsii-compiled TS output with long lines; readable code, not obfuscation. Stable for this package. ai
provenance publisher-changed AI (provenance): Publisher changed to GitHub Actions with SLSA provenance; legitimate CI/CD transition. ai
maintainer-change maintainer-removed AI (maintainer-change): cdklabs-automation replaced by equivalent AWS automation accounts. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainers are known AWS/projen contributors. ai
maintainer-change maintainer-takeover AI (maintainer-change): Legitimate AWS org transition: cdklabs-automation → mrgrain/amzn-oss/projen-automation. ai
source-diff obfuscated-file:lib/python/pyproject-toml.js AI (source-diff): jsii-compiled TypeScript; generated config types. ai
source-diff obfuscated-file:lib/awscdk/private/feature-flags-v2.const.js AI (source-diff): Generated CDK feature flags constant; long lines from large object literal. ai
source-diff obfuscated-file:lib/util/diff.js AI (source-diff): jsii-compiled TypeScript; readable diff utility. ai
source-diff obfuscated-file:lib/github/dependency-review.js AI (source-diff): jsii-compiled TypeScript; readable GitHub workflow component. ai
source-diff obfuscated-file:lib/release/commit-tag-version.js AI (source-diff): jsii-compiled TypeScript; readable release tooling. ai
source-diff obfuscated-file:lib/release/bump-type.js AI (source-diff): jsii-compiled TypeScript; readable semver utility functions. ai
source-diff obfuscated-file:lib/javascript/biome/biome.js AI (source-diff): jsii-compiled TypeScript class; readable source. ai
source-diff obfuscated-file:lib/ai-instructions.js AI (source-diff): jsii-compiled TypeScript, not obfuscated; readable source with JSDoc comments. ai
source-diff obfuscated-file:lib/javascript/biome/biome-config.js AI (source-diff): Generated config type definitions (toJson_ exports); long lines from many exports, not obfuscation. ai
semgrep semgrep:env-spread AI (semgrep): Task runner intentionally merges process.env with task-specific env vars; core design of projen. ai
semgrep semgrep:dynamic-require AI (semgrep): Plugin/module loader pattern; projen dynamically loads project modules by design. ai
semgrep semgrep:child-process-import AI (semgrep): CLI synth tool legitimately spawns child processes; expected for a project scaffolding tool. ai
phantom-deps phantom-dep:shx AI (phantom-deps): shx is listed in both dependencies and bundledDependencies; phantom-dep is a false positive here. ai

Versions (showing 100 of 222)

Version Deps Published
0.101.19 15 / 33
0.101.18 15 / 33
0.101.17 15 / 33
0.101.16 15 / 33
0.101.15 15 / 33
0.101.14 15 / 33
0.101.13 15 / 33
0.101.12 15 / 33
0.101.11 15 / 33
0.101.10 15 / 33
0.101.9 15 / 33
0.101.8 15 / 33
0.101.7 15 / 33
0.101.6 15 / 33
0.101.5 15 / 33
0.101.4 15 / 33
0.101.3 15 / 33
0.101.2 15 / 33
0.101.1 15 / 33
0.101.0 15 / 33
0.100.7 15 / 33
0.100.6 15 / 33
0.100.5 15 / 33
0.100.4 15 / 33
0.100.3 15 / 33
0.100.2 15 / 33
0.100.1 15 / 33
0.100.0 15 / 33
0.99.80 15 / 33
0.99.79 15 / 33
0.99.78 15 / 33
0.99.77 15 / 33
0.99.76 15 / 33
0.99.75 15 / 33
0.99.74 15 / 33
0.99.73 15 / 33
0.99.72 15 / 33
0.99.71 15 / 33
0.99.70 15 / 33
0.99.69 15 / 33
0.99.68 15 / 33
0.99.67 15 / 33
0.99.66 15 / 33
0.99.65 15 / 33
0.99.64 15 / 33
0.99.63 15 / 33
0.99.62 15 / 33
0.99.61 15 / 33
0.99.60 15 / 33
0.99.59 15 / 33
0.99.58 15 / 33
0.99.57 15 / 33
0.99.56 15 / 33
0.99.55 15 / 33
0.99.54 15 / 33
0.99.53 15 / 33
0.99.52 15 / 33
0.99.51 15 / 33
0.99.50 15 / 33
0.99.49 15 / 33
0.99.48 15 / 33
0.99.47 15 / 33
0.99.46 15 / 33
0.99.45 15 / 33
0.99.44 15 / 33
0.99.43 15 / 33
0.99.42 15 / 33
0.99.41 15 / 33
0.99.40 15 / 33
0.99.39 15 / 33
0.99.38 15 / 33
0.99.37 15 / 33
0.99.36 15 / 33
0.99.35 15 / 33
0.99.34 15 / 33
0.99.33 15 / 33
0.99.32 15 / 33
0.99.31 15 / 33
0.99.30 15 / 33
0.99.29 15 / 33
0.99.28 15 / 33
0.99.27 15 / 33
0.99.26 15 / 33
0.99.25 15 / 33
0.99.24 15 / 33
0.99.23 15 / 33
0.99.22 15 / 33
0.99.21 15 / 33
0.99.20 15 / 33
0.99.19 15 / 33
0.99.18 15 / 33
0.99.17 15 / 33
0.99.16 15 / 33
0.99.15 15 / 33
0.99.14 15 / 33
0.99.13 15 / 33
0.99.12 15 / 33
0.99.11 15 / 34
0.99.10 15 / 34
0.99.9 15 / 34
Showing 100 of 222 Next page →

v0.101.19

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.18

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.17

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.16

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.15

3 findings
HIGH New obfuscated file: lib/release/apply-version-bump.task.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/util/task-env.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.14

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.13

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.12

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.11

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.8

2 findings
HIGH New obfuscated file: lib/javascript/pnpm-workspace-config.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.7

2 findings
HIGH New obfuscated file: lib/javascript/pnpm-workspace-config.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.4

9 findings
HIGH New obfuscated file: lib/util/exec.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/run-task.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/synth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-runner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/task-runtime.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-shell.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/typescript/typescript-runner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: lib/run-task.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.3

8 findings
HIGH New obfuscated file: lib/util/exec.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/run-task.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/synth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-runner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/task-runtime.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-shell.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: lib/run-task.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.2

8 findings
HIGH New obfuscated file: lib/util/exec.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/run-task.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/synth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-runner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/task-runtime.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-shell.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: lib/run-task.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.1

8 findings
HIGH New obfuscated file: lib/util/exec.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/run-task.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/synth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-runner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/task-runtime.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-shell.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: lib/run-task.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.101.0

8 findings
HIGH New obfuscated file: lib/util/exec.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/run-task.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/cmds/synth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-runner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cli/task-runtime.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/task-shell.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: lib/run-task.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.26

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.25

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.24

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.23

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.22

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.21

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.20

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.19

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.18

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.17

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.16

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.15

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.14

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.13

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.12

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.11

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.99.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.