@jentic/api-scorecard-cli 1.0.0-alpha.11 → 1.0.0-alpha.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -8
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -95,25 +95,60 @@ export JENTIC_API_KEY=mvp-preview
|
|
|
95
95
|
This is a documented public placeholder for the alpha preview — not a secret. Real key issuance
|
|
96
96
|
arrives in a future release.
|
|
97
97
|
|
|
98
|
-
##
|
|
98
|
+
## Supply-chain attestations
|
|
99
99
|
|
|
100
|
-
`@jentic/api-scorecard-cli` alpha
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
100
|
+
Each `@jentic/api-scorecard-cli` alpha release ships with two independent
|
|
101
|
+
[Sigstore](https://www.sigstore.dev/)-signed attestations bound to the published tarball's
|
|
102
|
+
SHA-256 digest. Both are produced inside the GitHub Actions release workflow (no human
|
|
103
|
+
keyholder, no long-lived secrets) and are verifiable with the [GitHub CLI](https://cli.github.com/)
|
|
104
|
+
≥ 2.49.
|
|
105
|
+
|
|
106
|
+
| Attestation | Predicate type | What it claims | Where it lives |
|
|
107
|
+
|---|---|---|---|
|
|
108
|
+
| **npm provenance** | `https://slsa.dev/provenance/v1` | Where and how the tarball was built (workflow run, commit SHA, builder identity) | npm registry record + GitHub attestations index |
|
|
109
|
+
| **SPDX SBOM** | `https://spdx.dev/Document/v2.3` | The runtime dependency closure of the published tarball, in [SPDX 2.3](https://spdx.github.io/spdx-spec/v2.3/) form | GitHub attestations index |
|
|
110
|
+
|
|
111
|
+
Both attestations are present from **`1.0.0-alpha.11`** onward; earlier alphas have provenance
|
|
112
|
+
only (the SBOM attestation pipeline reached parity with the registry-served bytes in alpha.11).
|
|
113
|
+
|
|
114
|
+
### Verify a release
|
|
104
115
|
|
|
105
116
|
```bash
|
|
117
|
+
# 1. Download the published tarball
|
|
106
118
|
npm pack @jentic/api-scorecard-cli@alpha
|
|
107
119
|
|
|
108
|
-
# Verify provenance (gh's default predicate)
|
|
120
|
+
# 2. Verify the npm provenance (gh's default predicate type)
|
|
109
121
|
gh attestation verify ./jentic-api-scorecard-cli-*.tgz --owner jentic
|
|
110
122
|
|
|
111
|
-
# Verify the SBOM (non-default predicate, must be requested explicitly)
|
|
123
|
+
# 3. Verify the SPDX SBOM (non-default predicate type, must be requested explicitly)
|
|
112
124
|
gh attestation verify ./jentic-api-scorecard-cli-*.tgz --owner jentic \
|
|
113
125
|
--predicate-type https://spdx.dev/Document/v2.3
|
|
114
126
|
```
|
|
115
127
|
|
|
116
|
-
Each successful run reports `Loaded digest sha256:…` and lists the
|
|
128
|
+
Each successful run reports `Loaded digest sha256:…` and lists the matched attestation.
|
|
129
|
+
|
|
130
|
+
### Download the SBOM
|
|
131
|
+
|
|
132
|
+
`gh attestation verify` proves authenticity but doesn't print the SPDX document itself. The
|
|
133
|
+
SBOM is embedded as the `predicate` of the verified in-toto statement; extract it with
|
|
134
|
+
`--format json` and pipe through `jq`:
|
|
135
|
+
|
|
136
|
+
```bash
|
|
137
|
+
gh attestation verify ./jentic-api-scorecard-cli-*.tgz --owner jentic \
|
|
138
|
+
--predicate-type https://spdx.dev/Document/v2.3 \
|
|
139
|
+
--format json \
|
|
140
|
+
| jq '.[0].verificationResult.statement.predicate' \
|
|
141
|
+
> sbom.spdx.json
|
|
142
|
+
```
|
|
143
|
+
|
|
144
|
+
`sbom.spdx.json` is a complete SPDX 2.3 document — the document root carries the published
|
|
145
|
+
package's purl (`pkg:npm/@jentic/api-scorecard-cli@<version>`) and the `packages` array
|
|
146
|
+
enumerates every runtime dependency with its exact resolved version. Feed it directly to any
|
|
147
|
+
SPDX-aware tool ([Trivy](https://trivy.dev/), [Grype](https://github.com/anchore/grype),
|
|
148
|
+
[OSV-Scanner](https://github.com/google/osv-scanner)).
|
|
149
|
+
|
|
150
|
+
Tying download to verification is deliberate: the recipe above succeeds only if the signature
|
|
151
|
+
checks out, so you never end up with bytes that didn't pass the trust check.
|
|
117
152
|
|
|
118
153
|
## Status
|
|
119
154
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@jentic/api-scorecard-cli",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.13",
|
|
4
4
|
"description": "Score an OpenAPI document against the Jentic API AI Readiness Framework (JAIRF).",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"api",
|
|
@@ -62,5 +62,5 @@
|
|
|
62
62
|
"engines": {
|
|
63
63
|
"node": ">=20.10.0"
|
|
64
64
|
},
|
|
65
|
-
"gitHead": "
|
|
65
|
+
"gitHead": "5d4db43181cccd072483e467d3a7540402261e4d"
|
|
66
66
|
}
|