https://github.com/slsa-framework/source-tool
Score: -Infinity
Last synced: about 5 hours ago
JSON representation
Repository metadata:
A proof-of-concept for how the SLSA Source Track could be implemented.
- Host: GitHub
- URL: https://github.com/slsa-framework/source-tool
- Owner: slsa-framework
- License: apache-2.0
- Created: 2025-01-06T18:10:05.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2026-07-11T21:16:01.000Z (14 days ago)
- Last Synced: 2026-07-13T15:06:33.696Z (12 days ago)
- Language: Go
- Size: 4.56 MB
- Stars: 18
- Watchers: 3
- Forks: 17
- Open Issues: 27
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Owner metadata:
- Name: SLSA Framework
- Login: slsa-framework
- Email:
- Kind: organization
- Description: Supply-chain Levels for Software Artifacts
- Website: https://slsa.dev
- Location:
- Twitter:
- Company:
- Icon url: https://avatars.githubusercontent.com/u/80431187?v=4
- Repositories: 20
- Last Synced at: 2024-04-18T01:56:48.690Z
- Profile URL: https://github.com/slsa-framework
GitHub Events
Total
- Create event: 38
- Delete event: 46
- Issue comment event: 14
- Issues event: 12
- Pull request event: 122
- Pull request review comment event: 4
- Pull request review event: 18
- Push event: 48
- Release event: 1
- Watch event: 3
- Total: 306
Last Year
- Create event: 38
- Delete event: 46
- Issue comment event: 14
- Issues event: 12
- Pull request event: 122
- Pull request review comment event: 4
- Pull request review event: 18
- Push event: 48
- Release event: 1
- Watch event: 3
- Total: 306
Committers metadata
Last synced: 2 days ago
Total Commits: 298
Total Committers: 12
Avg Commits per committer: 24.833
Development Distribution Score (DDS): 0.517
Commits in past year: 118
Committers in past year: 6
Avg Commits per committer in past year: 19.667
Development Distribution Score (DDS) in past year: 0.475
| Name | Commits | |
|---|---|---|
| Tom Hennen | T****n | 144 |
| Puerco | p****o | 87 |
| dependabot[bot] | 4****] | 57 |
| Ralph Bean | r****n@r****m | 2 |
| Michael Winser | g****m@p****m | 1 |
| Michael Lieberman | m****5@g****m | 1 |
| Mend Renovate | r****e@w****m | 1 |
| Matt M | 4****e | 1 |
| Kairo Araujo | k****o@k****r | 1 |
| James Alseth | j****s@j****e | 1 |
| Gabriel De Obieta | d****a | 1 |
| Carlos Tadeu Panato Junior | c****u@g****m | 1 |
Issue and Pull Request metadata
Last synced: 2 days ago
Total issues: 6
Total pull requests: 40
Average time to close issues: 2 months
Average time to close pull requests: 3 days
Total issue authors: 1
Total pull request authors: 3
Average comments per issue: 0.17
Average comments per pull request: 0.35
Merged pull request: 20
Bot issues: 0
Bot pull requests: 28
Past year issues: 6
Past year pull requests: 40
Past year average time to close issues: 2 months
Past year average time to close pull requests: 3 days
Past year issue authors: 1
Past year pull request authors: 3
Past year average comments per issue: 0.17
Past year average comments per pull request: 0.35
Past year merged pull request: 20
Past year bot issues: 0
Past year bot pull requests: 28
Top Issue Authors
- puerco (6)
Top Pull Request Authors
- dependabot[bot] (28)
- puerco (11)
- cpanato (1)
Top Issue Labels
- readiness-pilot (3)
- bug (2)
- enhancement (1)
- readiness-final (1)
Top Pull Request Labels
- dependencies (28)
- go (18)
- github_actions (9)
- readiness-pilot (2)
- readiness-final (1)
- docker (1)
Package metadata
- Total packages: 1
- Total downloads: unknown
- Total dependent packages: 0
- Total dependent repositories: 0
- Total versions: 6
proxy.golang.org: github.com/slsa-framework/source-tool
- Homepage: https://github.com/slsa-framework/source-tool
- Documentation: https://pkg.go.dev/github.com/slsa-framework/source-tool#section-documentation
- Licenses: Apache-2.0
- Latest release: v0.7.0 (published 17 days ago)
- Last Synced: 2026-07-23T11:39:45.168Z (2 days ago)
- Versions: 6
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 5.164%
- Dependent repos count: 5.51%
- Forks count: 6.958%
- Average: 7.133%
- Stargazers count: 10.9%
Dependencies
.github/workflows/go-test.yml
actions
- actions/checkout 8e8c483db84b4bee98b60c0593521ed34d9990e8 composite
- actions/setup-go 4dc6199c7b1a012772edbd06daecab0f50c9053c composite
- arduino/setup-protoc c65c819552d16ad3c9b72d9dfd5ba5237b9c906b composite
- bufbuild/buf-setup-action a47c93e0b1648d5651a065437926377d060baa99 composite
actions/get_note/action.yml
actions
actions/slsa_with_provenance/action.yml
actions
go.sum
go
- 283 dependencies
go.mod
go
- dario.cat/mergo v1.0.1
- github.com/Microsoft/go-winio v0.6.2
- github.com/ProtonMail/go-crypto v1.3.0
- github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
- github.com/blang/semver v3.5.1+incompatible
- github.com/blang/semver/v4 v4.0.0
- github.com/carabiner-dev/signer v0.1.2
- github.com/carabiner-dev/vcslocator v0.3.2
- github.com/cenkalti/backoff/v5 v5.0.3
- github.com/cloudflare/circl v1.6.1
- github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be
- github.com/coreos/go-oidc/v3 v3.16.0
- github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467
- github.com/cyphar/filepath-securejoin v0.4.1
- github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
- github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352
- github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7
- github.com/emirpasic/gods v1.18.1
- github.com/fatih/color v1.18.0
- github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
- github.com/go-git/gcfg/v2 v2.0.2
- github.com/go-git/go-billy/v5 v5.6.2
- github.com/go-git/go-billy/v6 v6.0.0-20250627091229-31e2a16eef30
- github.com/go-git/go-git/v5 v5.16.2
- github.com/go-git/go-git/v6 v6.0.0-20250711134917-1f24ae85fe16
- github.com/go-jose/go-jose/v4 v4.1.3
- github.com/go-logr/logr v1.4.3
- github.com/go-logr/stdr v1.2.2
- github.com/go-openapi/analysis v0.24.1
- github.com/go-openapi/errors v0.22.4
- github.com/go-openapi/jsonpointer v0.22.1
- github.com/go-openapi/jsonreference v0.21.3
- github.com/go-openapi/loads v0.23.2
- github.com/go-openapi/runtime v0.29.2
- github.com/go-openapi/spec v0.22.1
- github.com/go-openapi/strfmt v0.25.0
- github.com/go-openapi/swag v0.25.4
- github.com/go-openapi/swag/cmdutils v0.25.4
- github.com/go-openapi/swag/conv v0.25.4
- github.com/go-openapi/swag/fileutils v0.25.4
- github.com/go-openapi/swag/jsonname v0.25.4
- github.com/go-openapi/swag/jsonutils v0.25.4
- github.com/go-openapi/swag/loading v0.25.4
- github.com/go-openapi/swag/mangling v0.25.4
- github.com/go-openapi/swag/netutils v0.25.4
- github.com/go-openapi/swag/stringutils v0.25.4
- github.com/go-openapi/swag/typeutils v0.25.4
- github.com/go-openapi/swag/yamlutils v0.25.4
- github.com/go-openapi/validate v0.25.1
- github.com/go-viper/mapstructure/v2 v2.4.0
- github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8
- github.com/google/certificate-transparency-go v1.3.2
- github.com/google/go-containerregistry v0.20.7
- github.com/google/go-github/v69 v69.2.0
- github.com/google/go-github/v73 v73.0.0
- github.com/google/go-querystring v1.1.0
- github.com/google/uuid v1.6.0
- github.com/gorilla/mux v1.8.1
- github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3
- github.com/hashicorp/go-cleanhttp v0.5.2
- github.com/hashicorp/go-retryablehttp v0.7.8
- github.com/in-toto/attestation v1.1.2
- github.com/in-toto/in-toto-golang v0.9.0
- github.com/inconshreveable/mousetrap v1.1.0
- github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
- github.com/jedisct1/go-minisign v0.0.0-20241212093149-d2f9f49435c7
- github.com/kevinburke/ssh_config v1.2.0
- github.com/mattn/go-colorable v0.1.14
- github.com/mattn/go-isatty v0.0.20
- github.com/mattn/go-runewidth v0.0.17
- github.com/maxbrunsfeld/counterfeiter/v6 v6.12.1
- github.com/migueleliasweb/go-github-mock v1.5.0
- github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481
- github.com/oklog/ulid v1.3.1
- github.com/olekukonko/errors v1.1.0
- github.com/olekukonko/ll v0.0.9
- github.com/olekukonko/tablewriter v1.1.0
- github.com/opencontainers/go-digest v1.0.0
- github.com/pjbgf/sha1cd v0.4.0
- github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
- github.com/pkg/errors v0.9.1
- github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
- github.com/rivo/uniseg v0.4.7
- github.com/sassoftware/relic v7.2.1+incompatible
- github.com/secure-systems-lab/go-securesystemslib v0.9.1
- github.com/sergi/go-diff v1.4.0
- github.com/shibumi/go-pathspec v1.3.0
- github.com/sigstore/protobuf-specs v0.5.0
- github.com/sigstore/rekor v1.4.3
- github.com/sigstore/rekor-tiles/v2 v2.0.1
- github.com/sigstore/sigstore v1.10.0
- github.com/sigstore/sigstore-go v1.1.4
- github.com/sigstore/timestamp-authority/v2 v2.0.3
- github.com/sirupsen/logrus v1.9.3
- github.com/skeema/knownhosts v1.3.1
- github.com/spf13/cobra v1.10.2
- github.com/spf13/pflag v1.0.10
- github.com/stretchr/testify v1.11.1
- github.com/theupdateframework/go-tuf v0.7.0
- github.com/theupdateframework/go-tuf/v2 v2.3.0
- github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c
- github.com/transparency-dev/merkle v0.0.2
- github.com/xanzy/ssh-agent v0.3.3
- go.mongodb.org/mongo-driver v1.17.6
- go.opentelemetry.io/auto/sdk v1.2.1
- go.opentelemetry.io/otel v1.38.0
- go.opentelemetry.io/otel/metric v1.38.0
- go.opentelemetry.io/otel/trace v1.38.0
- go.yaml.in/yaml/v3 v3.0.4
- golang.org/x/crypto v0.45.0
- golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
- golang.org/x/mod v0.30.0
- golang.org/x/net v0.47.0
- golang.org/x/oauth2 v0.33.0
- golang.org/x/sync v0.18.0
- golang.org/x/sys v0.38.0
- golang.org/x/term v0.37.0
- golang.org/x/text v0.31.0
- golang.org/x/time v0.14.0
- golang.org/x/tools v0.39.0
- google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4
- google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101
- google.golang.org/grpc v1.76.0
- google.golang.org/protobuf v1.36.11
- gopkg.in/warnings.v0 v0.1.2
- gopkg.in/yaml.v3 v3.0.1
- sigs.k8s.io/release-utils v0.12.2
.github/workflows/golangci-lint.yaml
actions
- actions/checkout 8e8c483db84b4bee98b60c0593521ed34d9990e8 composite
- actions/setup-go 4dc6199c7b1a012772edbd06daecab0f50c9053c composite
- golangci/golangci-lint-action 1e7e51e771db61008b38414a730f564565cf7c20 composite
.github/workflows/local_attest.yml
actions
.github/workflows/release.yaml
actions
- actions/checkout 8e8c483db84b4bee98b60c0593521ed34d9990e8 composite
- actions/setup-go 4dc6199c7b1a012772edbd06daecab0f50c9053c composite
- carabiner-dev/actions/install/bnd HEAD composite
- goreleaser/goreleaser-action e435ccd777264be153ace6237001ef4d979d3a7a composite
- kubernetes-sigs/release-actions/setup-tejolote 8af7b2a5596dff526de9db59b2c4b8457e9f52a1 composite
.github/workflows/compute_slsa_source.yml
actions
- slsa-framework/slsa-source-poc/actions/slsa_with_provenance main composite
actions/store_note/action.yml
actions