@suaveplan/slsa - SLSA L1-L2 supply-chain security: provenance, SBOM, DSSE attestations, Sigstore Rekor transparency-log client, policy evaluation, OTel audit events

Summary

SLSA L1-L2 supply-chain security for Suaveplan. Generates and verifies in-toto / SLSA v1.0 provenance, CycloneDX 1.5 SBOMs, DSSE attestation envelopes, and RFC 6962 Sigstore Rekor transparency-log proofs. Every capability emits structured OTel span events and raises typed SlsaError subclasses with stable error codes.

Documentation tree

assessment — (no submodules)
- assessment — (no submodules)
dsse — (no submodules)
- dsse — (no submodules)
errors — (no submodules)
- slsa-error — (no submodules)
otel — (no submodules)
- slsa-otel — (no submodules)
policy — (no submodules)
- policy — (no submodules)
provenance — (no submodules)
- canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
- digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
- provenance — (no submodules)
inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
sbom — (no submodules)
- sbom — (no submodules)
schemas — (no submodules)
- parse — (no submodules)
verification — (no submodules)
- checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
- verification — (no submodules)

- [assessment](./src/assessment/assessment.md) — _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — _(no submodules)_- [errors](./src/errors/slsa-error.md) — _(no submodules)_- [slsa-error](./src/errors/slsa-error.md) — _(no submodules)_- [otel](./src/otel/slsa-otel.md) — _(no submodules)_- [slsa-otel](./src/otel/slsa-otel.md) — _(no submodules)_- [policy](./src/policy/policy.md) — _(no submodules)_- [policy](./src/policy/policy.md) — _(no submodules)_- [provenance](./src/provenance/provenance.md) — _(no submodules)_- [canonical-json](./src/provenance/canonical-json.md) — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…

digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
sbom — (no submodules)- sbom — (no submodules)- schemas — (no submodules)- parse — (no submodules)- verification — (no submodules)- checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
- verification — (no submodules)- assessment — (no submodules)- dsse — (no submodules)- dsse — (no submodules)- errors — (no submodules)- slsa-error — (no submodules)- otel — (no submodules)- slsa-otel — (no submodules)- policy — (no submodules)- policy — (no submodules)- provenance — (no submodules)- canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
- digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
- provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
sbom — (no submodules)- sbom — (no submodules)- schemas — (no submodules)- parse — (no submodules)- verification — (no submodules)- checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
- verification — (no submodules)- assessment — (no submodules)- dsse — (no submodules)- dsse — (no submodules)- errors — (no submodules)- slsa-error — (no submodules)- otel — (no submodules)- slsa-otel — (no submodules)- policy — (no submodules)- policy — (no submodules)- provenance — (no submodules)- canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
- digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
- provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
sbom — (no submodules)- sbom — (no submodules)- schemas — (no submodules)- parse — (no submodules)- verification — (no submodules)- checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
- verification — (no submodules)- assessment — (no submodules)- dsse — (no submodules) - dsse — (no submodules)- errors — (no submodules) - slsa-error — (no submodules)- otel — (no submodules) - slsa-otel — (no submodules)- policy — (no submodules) - policy — (no submodules)- provenance — (no submodules) - canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
- digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
- provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
sbom — (no submodules) - sbom — (no submodules)- schemas — (no submodules) - parse — (no submodules)- verification — (no submodules) - checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
- verification — (no submodules)

Install

bun add @suaveplan/slsa

Quick start

import {
  assessSlsaLevel,
  generateProvenance,
  generateSbom,
  RekorClient,
  verifyProvenance,
  wrapInDsse,
} from "@suaveplan/slsa";

const statement = generateProvenance({
  packageName: "@suaveplan/utils",
  packageVersion: "1.2.3",
  artifactDigest: "abc123...",
  sourceCommit: "deadbeef...",
  sourceRepo: "https://gitlab.fq.io/suaveplan/project",
  sourceRef: "refs/heads/main",
  builderId: "https://gitlab.fq.io/suaveplan/project/-/runners/1",
  buildInvocationId: "ci-12345",
  buildStartedOn: new Date().toISOString(),
});

const result = verifyProvenance(statement, {
  trustedBuilders: ["https://gitlab.fq.io/suaveplan/project/-/runners/*"],
  expectedSourceRepo: "https://gitlab.fq.io/suaveplan/project",
});

const sbom = generateSbom({
  packageName: "@suaveplan/utils",
  packageVersion: "1.2.3",
  dependencies: { lodash: "4.17.21" },
});

const envelope = wrapInDsse(statement, signatures);
const rekor = new RekorClient();
const entry = await rekor.uploadIntoto(envelope);

console.log(assessSlsaLevel({ ...environment, hasRekorInclusion: true }).level);

Modules

errors/slsa-error — typed error hierarchy
- stable SLSA_* code registry.
otel/slsa-otel — OTel audit-event adapter.
schemas/parse — Zod-validated JSON parsers.
provenance/canonical-json — deterministic JSON encoder.
provenance/digest — SHA-256 helper over @suaveplan/crypto-hash.
provenance/provenance — in-toto / SLSA v1.0 statement generator.
verification/checks — individual verification rules.
verification/verification — policy-driven verifier.
sbom/sbom — CycloneDX 1.5 SBOM generator.
assessment/assessment — SLSA L0-L3 environment assessor.
attestation/dsse/dsse — DSSE PAE, envelope wrapper, ed25519 verification.
rekor/inclusion-proof — RFC 6962 Merkle inclusion proof verification.
rekor/rekor-client — Sigstore Rekor REST client.
policy/policy — composite policy evaluator.

Status

Tests: 170 passing (13 files).
Coverage: 99.2% statements, 100% functions, 99.44% lines, 95.15% branches.
Typecheck, lint, and build all green.