skills/plugins/document-navigator/docs/security-stack/security/slsa

@suaveplan/slsa - SLSA L1-L2 supply-chain security: provenance, SBOM, DSSE attestations, Sigstore Rekor transparency-log client, policy evaluation, OTel audit events

Summary

SLSA L1-L2 supply-chain security for Suaveplan. Generates and verifies in-toto / SLSA v1.0 provenance, CycloneDX 1.5 SBOMs, DSSE attestation envelopes, and RFC 6962 Sigstore Rekor transparency-log proofs. Every capability emits structured OTel span events and raises typed SlsaError subclasses with stable error codes.

Documentation tree

• assessment — (no submodules)
  • assessment — (no submodules)
• dsse — (no submodules)
  • dsse — (no submodules)
• errors — (no submodules)
  • slsa-error — (no submodules)
• otel — (no submodules)
  • slsa-otel — (no submodules)
• policy — (no submodules)
  • policy — (no submodules)
• provenance — (no submodules)
  • canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
  • digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
  • provenance — (no submodules)
• inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
• rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
• sbom — (no submodules)
  • sbom — (no submodules)
• schemas — (no submodules)
  • parse — (no submodules)
• verification — (no submodules)
  • checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  • verification — (no submodules)

- [assessment](./src/assessment/assessment.md) — _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — _(no submodules)_- [dsse](./src/attestation/dsse/dsse.md) — _(no submodules)_- [errors](./src/errors/slsa-error.md) — _(no submodules)_- [slsa-error](./src/errors/slsa-error.md) — _(no submodules)_- [otel](./src/otel/slsa-otel.md) — _(no submodules)_- [slsa-otel](./src/otel/slsa-otel.md) — _(no submodules)_- [policy](./src/policy/policy.md) — _(no submodules)_- [policy](./src/policy/policy.md) — _(no submodules)_- [provenance](./src/provenance/provenance.md) — _(no submodules)_- [canonical-json](./src/provenance/canonical-json.md) — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…

• digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
• provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
• rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
• sbom — (no submodules)- sbom — (no submodules)- schemas — (no submodules)- parse — (no submodules)- verification — (no submodules)- checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  • verification — (no submodules)- assessment — (no submodules)- dsse — (no submodules)- dsse — (no submodules)- errors — (no submodules)- slsa-error — (no submodules)- otel — (no submodules)- slsa-otel — (no submodules)- policy — (no submodules)- policy — (no submodules)- provenance — (no submodules)- canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
  • digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
  • provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
• rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
• sbom — (no submodules)- sbom — (no submodules)- schemas — (no submodules)- parse — (no submodules)- verification — (no submodules)- checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  • verification — (no submodules)- assessment — (no submodules)- dsse — (no submodules)- dsse — (no submodules)- errors — (no submodules)- slsa-error — (no submodules)- otel — (no submodules)- slsa-otel — (no submodules)- policy — (no submodules)- policy — (no submodules)- provenance — (no submodules)- canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
  • digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
  • provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
• rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
• sbom — (no submodules)- sbom — (no submodules)- schemas — (no submodules)- parse — (no submodules)- verification — (no submodules)- checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  • verification — (no submodules)- assessment — (no submodules)- dsse — (no submodules) - dsse — (no submodules)- errors — (no submodules) - slsa-error — (no submodules)- otel — (no submodules) - slsa-otel — (no submodules)- policy — (no submodules) - policy — (no submodules)- provenance — (no submodules) - canonical-json — Produces a byte-stable, lexicographically-ordered JSON encoding for provenance statements, SBOM documents, and DSSE pay…
  • digest — Single canonical entry point for SHA-256 digest computation inside the SLSA package. Deliberately routes through `@suav…
  • provenance — (no submodules)- inclusion-proof — Verifies an RFC 6962 Merkle inclusion proof as returned by Sigstore Rekor. Given a leaf (the canonical body a Rekor ent…
• rekor-client — Minimal Sigstore Rekor REST client for the two upload shapes Suaveplan cares about: hashedrekord v0.0.1 (when logging…
• sbom — (no submodules) - sbom — (no submodules)- schemas — (no submodules) - parse — (no submodules)- verification — (no submodules) - checks — Individual, stateless verification rules that consume a provenance statement plus policy inputs and return a structured…
  • verification — (no submodules)

Install

bun add @suaveplan/slsa

Quick start

import {
  assessSlsaLevel,
  generateProvenance,
  generateSbom,
  RekorClient,
  verifyProvenance,
  wrapInDsse,
} from "@suaveplan/slsa";

const statement = generateProvenance({
  packageName: "@suaveplan/utils",
  packageVersion: "1.2.3",
  artifactDigest: "abc123...",
  sourceCommit: "deadbeef...",
  sourceRepo: "https://gitlab.fq.io/suaveplan/project",
  sourceRef: "refs/heads/main",
  builderId: "https://gitlab.fq.io/suaveplan/project/-/runners/1",
  buildInvocationId: "ci-12345",
  buildStartedOn: new Date().toISOString(),
});

const result = verifyProvenance(statement, {
  trustedBuilders: ["https://gitlab.fq.io/suaveplan/project/-/runners/*"],
  expectedSourceRepo: "https://gitlab.fq.io/suaveplan/project",
});

const sbom = generateSbom({
  packageName: "@suaveplan/utils",
  packageVersion: "1.2.3",
  dependencies: { lodash: "4.17.21" },
});

const envelope = wrapInDsse(statement, signatures);
const rekor = new RekorClient();
const entry = await rekor.uploadIntoto(envelope);

console.log(assessSlsaLevel({ ...environment, hasRekorInclusion: true }).level);

Modules

• errors/slsa-error — typed error hierarchy
  • stable SLSA_* code registry.
• otel/slsa-otel — OTel audit-event adapter.
• schemas/parse — Zod-validated JSON parsers.
• provenance/canonical-json — deterministic JSON encoder.
• provenance/digest — SHA-256 helper over @suaveplan/crypto-hash.
• provenance/provenance — in-toto / SLSA v1.0 statement generator.
• verification/checks — individual verification rules.
• verification/verification — policy-driven verifier.
• sbom/sbom — CycloneDX 1.5 SBOM generator.
• assessment/assessment — SLSA L0-L3 environment assessor.
• attestation/dsse/dsse — DSSE PAE, envelope wrapper, ed25519 verification.
• rekor/inclusion-proof — RFC 6962 Merkle inclusion proof verification.
• rekor/rekor-client — Sigstore Rekor REST client.
• policy/policy — composite policy evaluator.

Status

• Tests: 170 passing (13 files).
• Coverage: 99.2% statements, 100% functions, 99.44% lines, 95.15% branches.
• Typecheck, lint, and build all green.