npm - @sourcey/catalog-verifier - Versions diffs - 1.2.2 → 1.2.5 - Mend

@sourcey/catalog-verifier 1.2.2 → 1.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (25) hide show

package/CHANGELOG.md +14 -0
package/SBOM.cdx.json +134 -8
package/SOURCEY-CLOSURE.json +18 -18
package/SOURCEY-LICENSE-POLICY.json +26 -9
package/THIRD_PARTY_NOTICES.json +109 -4
package/dist/contracts/agent-readiness/src/binding.d.ts +238 -36
package/dist/contracts/agent-readiness/src/binding.d.ts.map +1 -1
package/dist/contracts/agent-readiness/src/binding.js +88 -27
package/dist/contracts/agent-readiness/src/binding.js.map +1 -1
package/dist/contracts/agent-readiness/src/declaration.d.ts +196 -144
package/dist/contracts/agent-readiness/src/declaration.d.ts.map +1 -1
package/dist/contracts/agent-readiness/src/declaration.js +6 -1
package/dist/contracts/agent-readiness/src/declaration.js.map +1 -1
package/dist/contracts/agent-readiness/src/jobs.d.ts +1 -2
package/dist/contracts/agent-readiness/src/jobs.d.ts.map +1 -1
package/dist/contracts/agent-readiness/src/jobs.js +1 -1
package/dist/contracts/agent-readiness/src/jobs.js.map +1 -1
package/dist/contracts/agent-readiness/src/shared.d.ts +2 -2
package/dist/contracts/agent-readiness/src/shared.js +2 -2
package/dist/modules/agent-readiness-repository/src/index.d.ts.map +1 -1
package/dist/modules/agent-readiness-repository/src/index.js +1 -1
package/dist/modules/agent-readiness-repository/src/index.js.map +1 -1
package/distributions/licenses/sigstore-verify-3.1.1.txt +202 -0
package/package.json +4 -3
package/taxonomy.json +4 -4

package/CHANGELOG.md CHANGED Viewed

@@ -2,6 +2,20 @@
 Release notes are maintained per immutable package version in GitHub Releases.
+## 1.2.5
+- The taxonomy names its categories in full: AI and machine learning, APIs and integrations,
+  Authentication and security, and No-code tools.
+## 1.2.4
+1.2.3 was tagged but never reached npm; 1.2.4 carries its changes.
+- Releases publish to npm through npm's trusted publishing, with provenance.
+- Job bindings declare OAuth client credentials and refresh-token delegations, each
+  naming its token endpoint, and credentials placed as a query parameter. The `oauth`
+  delegation, which obtained consent inside a run, is removed.
 ## 1.2.0
 - Breaking: release verification leaves this package. `verify-release` and

package/SBOM.cdx.json CHANGED Viewed

@@ -44,11 +44,111 @@
       },
       {
         "name": "sourcey:license-policy-sha256",
-        "value": "sha256:42d44b9a8c8da9f48c20a5f1f4da61b1826888cf4d56764757350cc993fc1730"
+        "value": "sha256:582f3ef8f0554fc19d55af065091eb26e773d839ecfd362e40bd7e94cdd4ed16"
       }
     ]
   },
   "components": [
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/%40sigstore/verify@3.1.1",
+      "group": "@sigstore",
+      "name": "verify",
+      "licenses": [
+        {
+          "expression": "Apache-2.0"
+        }
+      ],
+      "version": "3.1.1",
+      "purl": "pkg:npm/%40sigstore/verify@3.1.1",
+      "hashes": [
+        {
+          "alg": "SHA-512",
+          "content": "aafefe1b727671ceb0c058f7c8abd739a9b3aa13304a4d6880f1a68694bc89796570fac968820103ee076edb651d5bb5a6a5937666821ff584ed4382e7591da0"
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://registry.npmjs.org/@sigstore/verify/-/verify-3.1.1.tgz"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/%40sigstore/bundle@4.0.0",
+      "group": "@sigstore",
+      "name": "bundle",
+      "licenses": [
+        {
+          "expression": "Apache-2.0"
+        }
+      ],
+      "version": "4.0.0",
+      "purl": "pkg:npm/%40sigstore/bundle@4.0.0",
+      "hashes": [
+        {
+          "alg": "SHA-512",
+          "content": "3700a5e58d15e838b435ec6f913a9da157e68d3690c282ccdb7eabf3d284a231a6abf8cc96cf12fb36fbc8ec003dd5ef6f07ca0e53fe9665e000be2f292413f8"
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-4.0.0.tgz"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/%40sigstore/core@3.2.1",
+      "group": "@sigstore",
+      "name": "core",
+      "licenses": [
+        {
+          "expression": "Apache-2.0"
+        }
+      ],
+      "version": "3.2.1",
+      "purl": "pkg:npm/%40sigstore/core@3.2.1",
+      "hashes": [
+        {
+          "alg": "SHA-512",
+          "content": "a91b313e70ab6c2fe9b9e806c4abb29df9f180b887a964adad28f192807860aaaadd9dece1cc99ca3e3665d5850046e534feb90beac11fc12e4441c85e88bcde"
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://registry.npmjs.org/@sigstore/core/-/core-3.2.1.tgz"
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/%40sigstore/protobuf-specs@0.5.2",
+      "group": "@sigstore",
+      "name": "protobuf-specs",
+      "licenses": [
+        {
+          "expression": "Apache-2.0"
+        }
+      ],
+      "version": "0.5.2",
+      "purl": "pkg:npm/%40sigstore/protobuf-specs@0.5.2",
+      "hashes": [
+        {
+          "alg": "SHA-512",
+          "content": "490aaf14cb7857bf1f7637037585fa1db89548e47840add983009ad8a3aca290203c81f2d6b539503526ccb974dabe68cb26987181d1d61a700d193fc947be33"
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "distribution",
+          "url": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.5.2.tgz"
+        }
+      ]
+    },
     {
       "type": "library",
       "bom-ref": "pkg:npm/entities@8.1.0",
@@ -99,25 +199,25 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/provenry@0.2.2",
+      "bom-ref": "pkg:npm/provenry@0.3.0",
       "name": "provenry",
       "licenses": [
         {
           "expression": "MIT"
         }
       ],
-      "version": "0.2.2",
-      "purl": "pkg:npm/provenry@0.2.2",
+      "version": "0.3.0",
+      "purl": "pkg:npm/provenry@0.3.0",
       "hashes": [
         {
           "alg": "SHA-512",
-          "content": "29f7b712498b45438146dfce8258889f9c120e330c3991a4d4a243f28bed25e572fdbaf13672f6be4226d44d6c54324a60870c34ba7f0a53d1494436d46aceb5"
+          "content": "18012f90894ca376cebfa83fae13c24f9aa538fa32442f77a1e29cd6c40e4e0e468b8174d6c5a596cd73e5df0078865eef48b08247529edc03598868712360a4"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://registry.npmjs.org/provenry/-/provenry-0.2.2.tgz"
+          "url": "https://registry.npmjs.org/provenry/-/provenry-0.3.0.tgz"
         }
       ]
     },
@@ -174,11 +274,33 @@
     {
       "ref": "urn:sourcey:code-distribution:catalog-verifier",
       "dependsOn": [
-        "pkg:npm/provenry@0.2.2",
+        "pkg:npm/provenry@0.3.0",
         "pkg:npm/yaml@2.9.1",
         "pkg:npm/zod@4.6.5"
       ]
     },
+    {
+      "ref": "pkg:npm/%40sigstore/verify@3.1.1",
+      "dependsOn": [
+        "pkg:npm/%40sigstore/bundle@4.0.0",
+        "pkg:npm/%40sigstore/core@3.2.1",
+        "pkg:npm/%40sigstore/protobuf-specs@0.5.2"
+      ]
+    },
+    {
+      "ref": "pkg:npm/%40sigstore/bundle@4.0.0",
+      "dependsOn": [
+        "pkg:npm/%40sigstore/protobuf-specs@0.5.2"
+      ]
+    },
+    {
+      "ref": "pkg:npm/%40sigstore/core@3.2.1",
+      "dependsOn": []
+    },
+    {
+      "ref": "pkg:npm/%40sigstore/protobuf-specs@0.5.2",
+      "dependsOn": []
+    },
     {
       "ref": "pkg:npm/entities@8.1.0",
       "dependsOn": []
@@ -190,8 +312,12 @@
       ]
     },
     {
-      "ref": "pkg:npm/provenry@0.2.2",
+      "ref": "pkg:npm/provenry@0.3.0",
       "dependsOn": [
+        "pkg:npm/%40sigstore/bundle@4.0.0",
+        "pkg:npm/%40sigstore/core@3.2.1",
+        "pkg:npm/%40sigstore/protobuf-specs@0.5.2",
+        "pkg:npm/%40sigstore/verify@3.1.1",
         "pkg:npm/parse5@8.0.1",
         "pkg:npm/zod@4.6.5"
       ]

package/SOURCEY-CLOSURE.json CHANGED Viewed

@@ -4,19 +4,19 @@
   "files": [
     {
       "path": "dist/contracts/agent-readiness/src/binding.d.ts",
-      "sha256": "sha256:3d536ecb9965657756eb038ac002beaf5e7e536c2fbd92d336714663cc45f38d"
+      "sha256": "sha256:96785f69d5e669ce78c0f5380e68d33415d5e4bdec443624c3fcaf9ea3ff6c9a"
     },
     {
       "path": "dist/contracts/agent-readiness/src/binding.d.ts.map",
-      "sha256": "sha256:5baf25a4ef9cff10f86c17422395a892f48baa91cfced12e56a1bffcd32703b4"
+      "sha256": "sha256:f82efa073177eb01678b1902ae0112bb30f55c511fbe7a1137466932003c3d91"
     },
     {
       "path": "dist/contracts/agent-readiness/src/binding.js",
-      "sha256": "sha256:f06db444f9a1ad3fc4716bd937aebbff6f739044e85aeb1c170fba37701786f8"
+      "sha256": "sha256:31870b30760f8b419016d261b05b6511c0e902e5cec2ef546bf7ec87c30695d9"
     },
     {
       "path": "dist/contracts/agent-readiness/src/binding.js.map",
-      "sha256": "sha256:4c5ac22667466ef4de0952f814881851af6cc26b7c6f9f239fbde75e3fcae20b"
+      "sha256": "sha256:7244eb4d3cf46afdd1a3d0f90fdb8cdbcde34a92f60aa7af8d185ba621a9eb15"
     },
     {
       "path": "dist/contracts/agent-readiness/src/declaration-reference.d.ts",
@@ -36,35 +36,35 @@
     },
     {
       "path": "dist/contracts/agent-readiness/src/declaration.d.ts",
-      "sha256": "sha256:85ab64af32e7851d686b65e9b669a202645671bca554461f24a5ca290d67c90d"
+      "sha256": "sha256:99b5f637ccc8bcc2c72a4abf9921f9783751275aecfad1abd0a42fea00b5bea5"
     },
     {
       "path": "dist/contracts/agent-readiness/src/declaration.d.ts.map",
-      "sha256": "sha256:2e6a1a791c170df3fd2163b36ae6ae12018fea816dd00b265084ec102b18c660"
+      "sha256": "sha256:afb080f6d8136199f78ccb2b6c22d45a38ecd53347e04b3564a238f3f3e35efc"
     },
     {
       "path": "dist/contracts/agent-readiness/src/declaration.js",
-      "sha256": "sha256:aacd32746bafc500254a24a3596d7be169986a09a078a3d954d2b6ecba0778b7"
+      "sha256": "sha256:4ad31085325fc886f3aeabc81a3d0908884769890ab95eef31ef19e3066f639a"
     },
     {
       "path": "dist/contracts/agent-readiness/src/declaration.js.map",
-      "sha256": "sha256:6d851df8ffe4a6905876ad6b0756e6649f3fffd7cbe126c552b714aa54590d38"
+      "sha256": "sha256:c2125e71b4cb88ccde11c68cf0833b5d2fda4fc117727deeec6050496321169e"
     },
     {
       "path": "dist/contracts/agent-readiness/src/jobs.d.ts",
-      "sha256": "sha256:151c7e3b27a2da5c8aeaba9cf51fe60113feabfff45d331d87df0254b87e8067"
+      "sha256": "sha256:a6743b5e1f1db1aa87cf6599e1683cd0817394290d96684696a5768fd9b4dedd"
     },
     {
       "path": "dist/contracts/agent-readiness/src/jobs.d.ts.map",
-      "sha256": "sha256:93347ab4d63ff5d706c77787fd780b3ecd010989e3b1c4720ab1e292524f7043"
+      "sha256": "sha256:1022b2bceab11b46203e249459c88fbd2d4ffc3ddfb61d884484b73979446541"
     },
     {
       "path": "dist/contracts/agent-readiness/src/jobs.js",
-      "sha256": "sha256:9abfc4cfdaa2ccea3411f29fdf950541bfd22271a953069b5734cf8de1835891"
+      "sha256": "sha256:8e7b38d5e8340e5527506cfd3b2f66444eabdb7f257f2006d1c8e5ac0f7afd40"
     },
     {
       "path": "dist/contracts/agent-readiness/src/jobs.js.map",
-      "sha256": "sha256:ee4e87fbb2b3c2deed41c10876ad3fab7de2eacb2bedac6065941a15c701910d"
+      "sha256": "sha256:4bd6883f6b3d173319c40667ea51d3193892696afac8a45fe4baeec7644b1a8c"
     },
     {
       "path": "dist/contracts/agent-readiness/src/operation.d.ts",
@@ -84,7 +84,7 @@
     },
     {
       "path": "dist/contracts/agent-readiness/src/shared.d.ts",
-      "sha256": "sha256:8d881ed31d378ded6d56167a9e7abfd25db92e6ab963a746244ceac59a0218d2"
+      "sha256": "sha256:d1bff9bb0cf3b2886af544e36e74f7e32f81b708d8c75e1e869878a786ad0f2c"
     },
     {
       "path": "dist/contracts/agent-readiness/src/shared.d.ts.map",
@@ -92,7 +92,7 @@
     },
     {
       "path": "dist/contracts/agent-readiness/src/shared.js",
-      "sha256": "sha256:0255240eb58e4a82f133cfbf207159cab3b166d0877fe9d375066aae1beffbcb"
+      "sha256": "sha256:d74e7a1743a971fee9961d2dae056027fe7f57d499d65d55c66a1482c6bad73c"
     },
     {
       "path": "dist/contracts/agent-readiness/src/shared.js.map",
@@ -296,15 +296,15 @@
     },
     {
       "path": "dist/modules/agent-readiness-repository/src/index.d.ts.map",
-      "sha256": "sha256:dea25d5101605872c27d20a0e327456d1cdcc2df36e051eeb119585c39120427"
+      "sha256": "sha256:797b9892e2ffe0d705a92b40b1499d3e7ccdebf3690c660ed920693fdacd6c4a"
     },
     {
       "path": "dist/modules/agent-readiness-repository/src/index.js",
-      "sha256": "sha256:b38028a2575e1f1853c7473fa2f204c68b85985789a24b9a23b164842395d14b"
+      "sha256": "sha256:ee89ccef8801b9355bab532fe64bfcf0e28a97420e350f5a3b0545ad7990e68f"
     },
     {
       "path": "dist/modules/agent-readiness-repository/src/index.js.map",
-      "sha256": "sha256:6ead10b764373086aba3a30e685a92f0632acecfecb0cf8bc0e294b4e9e2dec1"
+      "sha256": "sha256:25dea826feccce48d324a8d382996358b67a4870e3cde9037ca7315cc95bfd29"
     },
     {
       "path": "dist/modules/authority/src/identity-context.d.ts",
@@ -595,5 +595,5 @@
       "sha256": "sha256:03838bd3077b4c16b4db7cd4d3e94722fbeb27e12a9593272af716425e64e5e7"
     }
   ],
-  "closure_digest": "sha256:8c5d95ac282e3372205d1166186f0696d0da637c562a60a8c1cf4d5b199031cb"
+  "closure_digest": "sha256:454ffdaadd73f8f7775b6cc1f783f09d5264b0d19304dd15d26450e1ce5e523c"
 }

package/SOURCEY-LICENSE-POLICY.json CHANGED Viewed

@@ -1,16 +1,15 @@
 {
   "code_distribution_license_policy_contract": "sourcey.code-distribution-license-policy/v1",
   "package_license": "MIT",
-  "allowed_dependency_licenses": ["Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "MIT"],
+  "allowed_dependency_licenses": [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "MIT",
+    "Unlicense"
+  ],
   "reviewed_license_texts": [
-    {
-      "package": "data-uri-to-buffer",
-      "version": "4.0.1",
-      "license": "MIT",
-      "path": "README.md",
-      "sha256": "sha256:a7cc4332acfa1f9b6530e01aac77fefe74f2efa32579215fddaa473013f9a25c",
-      "reason": "Upstream ships the full MIT license text inside README.md under its License heading and no separate license file; pulled by @google/genai through google-auth-library, gaxios and node-fetch."
-    },
     {
       "package": "@nodable/entities",
       "version": "3.1.0",
@@ -19,5 +18,23 @@
       "sha256": "sha256:7e3484a07c208b5c5813290a993244c6841efc3d4241c29a07ef948e8129a758",
       "reason": "Upstream ships its MIT license notice in README.md and no separate license file; pulled by fast-xml-parser for safe submitted SVG inspection."
     }
+  ],
+  "supplied_license_texts": [
+    {
+      "package": "err-code",
+      "version": "2.0.3",
+      "license": "MIT",
+      "path": "distributions/licenses/err-code-2.0.3.txt",
+      "sha256": "sha256:5cfd203775f0b7ba0bd84e059d37b224c161497bf2a2d649a13fabce46c1c452",
+      "reason": "Upstream declares MIT in package.json and ships no license text in its package or its repository at the release's commit; this is the standard MIT text naming the package's declared author. Pulled by @sigstore/sign through promise-retry."
+    },
+    {
+      "package": "@sigstore/verify",
+      "version": "3.1.1",
+      "license": "Apache-2.0",
+      "path": "distributions/licenses/sigstore-verify-3.1.1.txt",
+      "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+      "reason": "Upstream declares Apache-2.0 in package.json and its package ships no license text; this is sigstore-js's root LICENSE at the release's commit (1a8709a), byte-identical to the text @sigstore/core ships. Pulled by provenry's GitHub Actions verifiers."
+    }
   ]
 }

package/THIRD_PARTY_NOTICES.json CHANGED Viewed

@@ -3,8 +3,68 @@
   "distribution_id": "catalog-verifier",
   "package_name": "@sourcey/catalog-verifier",
   "package_license": "MIT",
-  "license_policy_sha256": "sha256:42d44b9a8c8da9f48c20a5f1f4da61b1826888cf4d56764757350cc993fc1730",
+  "license_policy_sha256": "sha256:582f3ef8f0554fc19d55af065091eb26e773d839ecfd362e40bd7e94cdd4ed16",
   "dependencies": [
+    {
+      "name": "@sigstore/verify",
+      "version": "3.1.1",
+      "license": "Apache-2.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/verify/-/verify-3.1.1.tgz",
+      "integrity": "sha512-qv7+G3J2cc6wwFj3yKvXOamzqhMwSk1ogPGmhpS8iXllcPrJaIIBA+4HbttlHVu1pqWTdmaCH/WE7UOC51kdoA==",
+      "lock_path": "node_modules/@sigstore/verify",
+      "license_files": [
+        {
+          "path": "distributions/licenses/sigstore-verify-3.1.1.txt",
+          "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+          "bytes": 11351
+        }
+      ]
+    },
+    {
+      "name": "@sigstore/bundle",
+      "version": "4.0.0",
+      "license": "Apache-2.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-4.0.0.tgz",
+      "integrity": "sha512-NwCl5Y0V6Di0NexvkTqdoVfmjTaQwoLM236r89KEojGmq/jMls8S+zb7yOwAPdXvbwfKDlP+lmXgAL4vKSQT+A==",
+      "lock_path": "node_modules/@sigstore/verify/node_modules/@sigstore/bundle",
+      "license_files": [
+        {
+          "path": "node_modules/@sigstore/verify/node_modules/@sigstore/bundle/LICENSE",
+          "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+          "bytes": 11351
+        }
+      ]
+    },
+    {
+      "name": "@sigstore/core",
+      "version": "3.2.1",
+      "license": "Apache-2.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-3.2.1.tgz",
+      "integrity": "sha512-qRsxPnCrbC/puegGxKuynfnxgLiHqWStrSjxkoB4YKqq3Z3s4cyZyj42ZdWFAEblNP65C+rBH8EuREHIXoi83g==",
+      "lock_path": "node_modules/@sigstore/verify/node_modules/@sigstore/core",
+      "license_files": [
+        {
+          "path": "node_modules/@sigstore/verify/node_modules/@sigstore/core/LICENSE",
+          "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+          "bytes": 11351
+        }
+      ]
+    },
+    {
+      "name": "@sigstore/protobuf-specs",
+      "version": "0.5.2",
+      "license": "Apache-2.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.5.2.tgz",
+      "integrity": "sha512-SQqvFMt4V78fdjcDdYX6HbiVSOR4QK3ZgwCa2KOsopAgPIHy1rU5UDUmzLl02r5oyyaYcYHR1hpwDRk/yUe+Mw==",
+      "lock_path": "node_modules/@sigstore/verify/node_modules/@sigstore/protobuf-specs",
+      "license_files": [
+        {
+          "path": "node_modules/@sigstore/verify/node_modules/@sigstore/protobuf-specs/LICENSE",
+          "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+          "bytes": 11351
+        }
+      ]
+    },
     {
       "name": "entities",
       "version": "8.1.0",
@@ -37,10 +97,10 @@
     },
     {
       "name": "provenry",
-      "version": "0.2.2",
+      "version": "0.3.0",
       "license": "MIT",
-      "resolved": "https://registry.npmjs.org/provenry/-/provenry-0.2.2.tgz",
-      "integrity": "sha512-Kfe3EkmLRUOBRt/OgliIn5wSDjMMOZGk1KJD8ovtJeVy/brxNnL2vkIm1E1sVDJKYIcMNLp/ClPRSUQ21GrOtQ==",
+      "resolved": "https://registry.npmjs.org/provenry/-/provenry-0.3.0.tgz",
+      "integrity": "sha512-GAEvkIlMo3bOv6g/rhPCT5qlOPoyRC93oeKc1sQOTg5Gi4F01sWlls1z5d8AeIZe70iwgkdSntwDWYhocSNgpA==",
       "lock_path": "node_modules/provenry",
       "license_files": [
         {
@@ -50,6 +110,51 @@
         }
       ]
     },
+    {
+      "name": "@sigstore/bundle",
+      "version": "4.0.0",
+      "license": "Apache-2.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-4.0.0.tgz",
+      "integrity": "sha512-NwCl5Y0V6Di0NexvkTqdoVfmjTaQwoLM236r89KEojGmq/jMls8S+zb7yOwAPdXvbwfKDlP+lmXgAL4vKSQT+A==",
+      "lock_path": "node_modules/provenry/node_modules/@sigstore/bundle",
+      "license_files": [
+        {
+          "path": "node_modules/provenry/node_modules/@sigstore/bundle/LICENSE",
+          "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+          "bytes": 11351
+        }
+      ]
+    },
+    {
+      "name": "@sigstore/core",
+      "version": "3.2.1",
+      "license": "Apache-2.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-3.2.1.tgz",
+      "integrity": "sha512-qRsxPnCrbC/puegGxKuynfnxgLiHqWStrSjxkoB4YKqq3Z3s4cyZyj42ZdWFAEblNP65C+rBH8EuREHIXoi83g==",
+      "lock_path": "node_modules/provenry/node_modules/@sigstore/core",
+      "license_files": [
+        {
+          "path": "node_modules/provenry/node_modules/@sigstore/core/LICENSE",
+          "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+          "bytes": 11351
+        }
+      ]
+    },
+    {
+      "name": "@sigstore/protobuf-specs",
+      "version": "0.5.2",
+      "license": "Apache-2.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.5.2.tgz",
+      "integrity": "sha512-SQqvFMt4V78fdjcDdYX6HbiVSOR4QK3ZgwCa2KOsopAgPIHy1rU5UDUmzLl02r5oyyaYcYHR1hpwDRk/yUe+Mw==",
+      "lock_path": "node_modules/provenry/node_modules/@sigstore/protobuf-specs",
+      "license_files": [
+        {
+          "path": "node_modules/provenry/node_modules/@sigstore/protobuf-specs/LICENSE",
+          "sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
+          "bytes": 11351
+        }
+      ]
+    },
     {
       "name": "yaml",
       "version": "2.9.1",