Package org.apache.commons.release.plugin.slsa.v1_2

package org.apache.commons.release.plugin.slsa.v1_2
SLSA 1.2 Build Attestation Models.

This package provides Jackson-annotated model classes that implement the Supply-chain Levels for Software Artifacts (SLSA) v1.2 specification.

Overview

SLSA is a framework for evaluating and improving the security posture of build systems. SLSA v1.2 defines a standard for recording build provenance: information about how software artifacts were produced.

Since:
1.10.0
See Also:
  • Classes
    Class
    Description
    BuildDefinition
    Inputs that define the build: the build type, external and internal parameters, and resolved dependencies.
    Builder
    Entity that executed the build and is trusted to have correctly performed the operation and populated the provenance.
    BuildMetadata
    Metadata about a build invocation: its identifier and start and finish timestamps.
    DsseEnvelope
    DSSE (Dead Simple Signing Envelope) that wraps a signed in-toto statement payload.
    Provenance
    Root predicate of an SLSA v1.2 provenance attestation, describing what was built and how.
    ResourceDescriptor
    Description of an artifact or resource referenced in the build, identified by URI and cryptographic digest.
    RunDetails
    Details about the build invocation: the builder identity, execution metadata, and any byproduct artifacts.
    Signature
    A single cryptographic signature within a DSSE envelope.
    Statement
    In-toto v1 attestation envelope that binds a set of subject artifacts to an SLSA provenance predicate.