30 lines
2.2 KiB
Markdown
30 lines
2.2 KiB
Markdown
# OpenSpec Change: slsa-spec-conformance
|
|
|
|
- **Change ID**: slsa-spec-conformance
|
|
- **Package**: `@suaveplan/slsa`
|
|
- **Status**: PROPOSED
|
|
- **Date**: 2026-04-26
|
|
|
|
## Summary
|
|
|
|
Add `**Verified by:**` lines to every requirement in `openspec/specs/slsa/spec.md` and pin previously-unverified structural scenarios — SLSA-04 (no `node:crypto` in `src/`), SLSA-14 (sibling `.md` per non-test source), SLSA-15 (subpath exports), SLSA-16 (coverage floor) — with `src/spec-conformance.test.ts`. No public-API or behavioural changes.
|
|
|
|
## Current state
|
|
|
|
`@suaveplan/slsa` ships in-toto v1 + SLSA v1.0 provenance generation, baseline + policy verification, CycloneDX 1.5 SBOM, DSSE PAE / envelope wrap / verify, RFC 6962 inclusion-proof verification, Sigstore Rekor v1 client (hashedrekord + intoto), policy evaluator, OTel adapter, structured errors with stable code registry, Zod schemas for every wire-format type, and `assessSlsaLevel` / `detectEnvironment`. Per-feature unit tests cover behaviour. The structural scenarios (no `node:crypto` import; sibling docs; subpath exports; coverage floor) were not pinned at runtime, and no requirement carried a `**Verified by:**` annotation.
|
|
|
|
The `schemas-at-boundaries` warns are by-design — every wire-format Zod schema is invoked at the `parseProvenance` / `parseSbom` / `RekorEntrySchema.safeParse` boundary inside `src/schemas/` or `src/rekor/`. The conformance script flags them because the call site is inside `src/schemas/`, not because they are unused.
|
|
|
|
## What changes
|
|
|
|
1. Annotate every requirement (SLSA-01 through SLSA-16) in the folded spec with a `**Verified by:**` line.
|
|
2. Add `src/spec-conformance.test.ts` covering SLSA-04 (no `node:crypto` import), SLSA-14 (sibling `.md` for every non-test, non-types, non-schema, non-bench, non-barrel source), SLSA-15 (every documented subpath export present), and SLSA-16 (vitest config declares ≥100 floor on all four metrics).
|
|
3. `bun scripts/openspec-conformance.ts @suaveplan/slsa` reports zero errors. The 26 `schemas-at-boundaries` warns remain by design.
|
|
|
|
## Impact
|
|
|
|
- Public API unchanged.
|
|
- One new test file (~110 lines).
|
|
- `openspec/specs/slsa/spec.md` gains 16 `**Verified by:**` blocks.
|
|
- Coverage stays at the 100% floor (current 100/100/100/100 threshold).
|