#1019904 ITP: slsa-verifier -- Verifies SLSA provenance (slsa.dev)

Package:
wnpp
Source:
wnpp
Submitter:
Laurent Simon
Date:
2025-11-29 16:51:40 UTC
Severity:
normal
#1019904#5
Date:
2022-09-16 00:12:58 UTC
From:
To:
* Package name    : slsa-verifier
  Version         : 2.0.0
* URL             : https://github.com/slsa-framework/slsa-verifier
* License         : Apache License 2.0
* Programming Lang: Go
  Description     : Verifies SLSA provenance

Supply chain Levels for Software Artifacts, or SLSA (salsa).
It’s a security framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises.

The slsa-verifier project is a utility to verify SLSA provenance generated by builders:
- Google Cloud Builders
- GitHub native builders
(https://github.com/slsa-framework/slsa-github-generator).

How do you plan to maintain it? Inside the Go packaging team

Are you looking for co-maintainers? No

Do you need a sponsor? I already have one.