Data

Tools

Indexes

Applications

Experiments

Packages

An open API service providing package, version and dependency metadata of many open source software ecosystems and registries.

Top 4.8% on proxy.golang.org
Top 5.1% dependent packages on proxy.golang.org
Top 4.8% dependent repos on proxy.golang.org
Top 4.4% forks on proxy.golang.org

proxy.golang.org : github.com/slsa-framework/slsa-verifier

Verify provenance from SLSA compliant builders

Registry - Source - Documentation - JSON
purl: pkg:golang/github.com/slsa-framework/slsa-verifier
License: Apache-2.0
Latest release: over 2 years ago
First release: almost 3 years ago
Namespace: github.com/slsa-framework
Dependent packages: 1
Dependent repositories: 1
Stars: 81 on GitHub
Forks: 26 on GitHub
See more repository details: repos.ecosyste.ms
Last synced: 22 days ago

Low
GSA_kwCzR0hTQS1yMnh2LXZwcjItNDJtOc4AA2_p
slsa-verifier vulnerable to mproper validation of npm's publish attestations
Ecosystems: go
Packages: github.com/slsa-framework/slsa-verifier, github.com/slsa-framework/slsa-verifier/v2
Source: github
Published: over 1 year ago