130 lines
4.2 KiB
Markdown
130 lines
4.2 KiB
Markdown
# Tasks — enterprise-slsa
|
|
|
|
> Closed 2026-04-19 — landed alongside this change; all tasks completed unless noted.
|
|
|
|
## Package scaffolding
|
|
|
|
- [x] Move from `src/lib/*.ts` flat layout to co-located four-file
|
|
feature modules.
|
|
- [x] Rewrite `package.json` with per-feature subpath `exports`.
|
|
- [x] Rewrite `vite.config.ts` for preserveModules + workspace externals.
|
|
- [x] Drop legacy `tsconfig.json`; keep `tsconfig.lib.json` only.
|
|
- [x] Rewrite `vitest.config.ts` with istanbul provider and
|
|
polyfills setup file.
|
|
- [x] Create `tests/setup/polyfills.ts` to polyfill WebCrypto under
|
|
Node.
|
|
|
|
## Dependencies
|
|
|
|
- [x] Add `@suaveplan/error` (workspace).
|
|
- [x] Add `@suaveplan/types` (workspace).
|
|
- [x] Add `@suaveplan/crypto` (workspace).
|
|
- [x] Add `@suaveplan/crypto-hash` (workspace).
|
|
- [x] Add `@suaveplan/crypto-utils` (workspace).
|
|
- [x] Add `@suaveplan/serialize` (workspace).
|
|
- [x] Add `@opentelemetry/api` (catalog:observability).
|
|
- [x] Add `zod` (catalog:forms).
|
|
|
|
## Errors
|
|
|
|
- [x] Create `SLSA_CODES` registry via `defineCodes`.
|
|
- [x] Create `SlsaError` base class.
|
|
- [x] Create `InvalidProvenanceError`.
|
|
- [x] Create `InvalidSbomError`.
|
|
- [x] Create `VerificationFailedError`.
|
|
- [x] Create `PolicyViolationError`.
|
|
- [x] Create `RekorUploadError`.
|
|
- [x] Create `RekorInclusionError`.
|
|
- [x] Create `AttestationInvalidError`.
|
|
- [x] Create `EnvironmentUnsupportedError`.
|
|
- [x] Co-located tests, md, and barrel.
|
|
|
|
## Schemas
|
|
|
|
- [x] Provenance schemas (`ProvenanceStatementSchema` and descendants).
|
|
- [x] SBOM schemas (`SbomSchema`, `SbomInputSchema`, components).
|
|
- [x] Verification schemas (`VerificationPolicySchema`,
|
|
`VerificationResultSchema`, assessment).
|
|
- [x] Attestation schemas (`DsseEnvelopeSchema`, `RekorEntrySchema`,
|
|
`InclusionProofSchema`).
|
|
- [x] `parseProvenance` / `parseSbom` with structured error output.
|
|
- [x] `parseProvenance` / `parseSbom` tests.
|
|
|
|
## OTel
|
|
|
|
- [x] `SlsaEventAttributes` typed attribute bag.
|
|
- [x] `SlsaOtelAdapter` interface + `createSlsaOtelAdapter` factory.
|
|
- [x] `noopSlsaOtelAdapter` default.
|
|
- [x] Co-located tests, md.
|
|
|
|
## Provenance
|
|
|
|
- [x] `canonicalize` (sorted-key JSON).
|
|
- [x] `computeDigest` via `@suaveplan/crypto-hash`.
|
|
- [x] `generateProvenance` with Zod-compatible inputs.
|
|
- [x] Validation via structured errors.
|
|
- [x] `serializeProvenance`, `hashProvenance`.
|
|
- [x] OTel `slsa.provenance.generated` event wiring.
|
|
- [x] Co-located tests, md.
|
|
|
|
## Verification
|
|
|
|
- [x] Split `checks.ts` rule file.
|
|
- [x] Add `checkBuildAge`, `checkSourceRepoPrefix`, `allowedBuilders`.
|
|
- [x] `verifyProvenance` with injectable clock and OTel adapter.
|
|
- [x] Co-located tests, md.
|
|
|
|
## SBOM
|
|
|
|
- [x] `generateSbom` with injectable clock + serial.
|
|
- [x] Structured `InvalidSbomError` on missing fields.
|
|
- [x] `serializeSbom`, `hashSbom`, `buildPurl`.
|
|
- [x] Co-located tests, md.
|
|
|
|
## Assessment
|
|
|
|
- [x] `assessSlsaLevel` with optional Rekor inclusion signal.
|
|
- [x] `detectEnvironment` reading `SLSA_*` env vars.
|
|
- [x] Co-located tests, md.
|
|
|
|
## Attestation (DSSE)
|
|
|
|
- [x] `encodeDssePae` per DSSE spec.
|
|
- [x] `wrapInDsse`.
|
|
- [x] `verifyDsseEnvelope` (ed25519, keyid scoping).
|
|
- [x] Co-located tests, md.
|
|
|
|
## Rekor
|
|
|
|
- [x] `verifyRfc6962InclusionProof` with odd-size carry-up.
|
|
- [x] `rfc6962LeafHash` utility.
|
|
- [x] `RekorClient` with injectable `fetch`.
|
|
- [x] `uploadHashedrekord` v0.0.1.
|
|
- [x] `uploadIntoto` v0.0.2 (computes payload sha256 automatically).
|
|
- [x] `getEntryByUuid`, `getEntryByLogIndex`.
|
|
- [x] `verifyInclusionProof` emits
|
|
`slsa.rekor.inclusion_verified` OTel event.
|
|
- [x] Response envelope flattening + Zod validation.
|
|
- [x] Co-located tests (no live Rekor), md.
|
|
|
|
## Policy
|
|
|
|
- [x] `evaluatePolicy` layering provenance verification + DSSE
|
|
signatures + Rekor inclusion + min SLSA level.
|
|
- [x] OTel `slsa.policy.violation` on failures.
|
|
- [x] Co-located tests, md.
|
|
|
|
## Docs
|
|
|
|
- [x] Co-located `.md` for every `.ts` implementation file.
|
|
- [x] Root `README.md` rewritten with Modules section.
|
|
|
|
## Verification
|
|
|
|
- [x] `bunx turbo typecheck --filter=@suaveplan/slsa` green.
|
|
- [x] `bunx turbo lint --filter=@suaveplan/slsa` green.
|
|
- [x] `bunx turbo test --filter=@suaveplan/slsa` green (170 tests).
|
|
- [x] `bunx turbo test:coverage --filter=@suaveplan/slsa` meets 95%
|
|
threshold on every axis.
|
|
- [x] `bunx turbo build --filter=@suaveplan/slsa` green.
|