Skip to content

Enhance the plugin to generate SLSA provenance data for a multi-module application #6

@thasnim-fluxone

Description

@thasnim-fluxone

Description:

Update the slsa-maven-plugin to ensure SLSA provenance data is generated correctly for all modules in a multi-module Maven project.

Sample SLSA provenance data structure for a multi-module maven project

{
    "_type": "https://in-toto.io/Statement/v1",
    "subject": [
        {
            "name": "core.jar",
            "digest": {
                "sha256": "<sha-for-core.jar>"
            }
        },
        {
            "name": "service.jar",
            "digest": {
                "sha256": "<sha-for-service.jar>"
            }
        },
        {
            "name": "webapp.war",
            "digest": {
                "sha256": "<sha-for-webapp.war>"
            }
        }
    ],
    "predicateType": "https://slsa.dev/provenance/v1",
    "predicate": {
        "buildDefinition": {
            "resolvedDependencies": [
                <roll up of all the dependencies between the parent and sub-modules>
            ],
            ...
        },
        ...
    }
    ```
    ...
}

=================================================================

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions