Status · SLSA 1.1

Title

Assignees

Status

1

cleanup verifying-source content

#1242

zachariahcox

Todo

2

Clarify 'Tamper with provenance or VSA' threat

#1223

TomHennen

Done

3

Clarify why builder level is meaningful in threats

#1215

Todo

4

Rephrase "The update did not match the code submitted to GitHub"?

#1213

Todo

5

TODO: Need mitigation description for "Use a compromised build tool" threat

#1184

TomHennen

Done

6

TODO: Need mitigation description for "Include a vulnerable dependency" threat

#1183

Todo

7

TODO: Need mitigation description for "Dependency confusion" threat

#1181

meder

Todo

8

TODO: Need mitigation description for "Software producer intentionally submits bad code" threat

#1178

zachariahcox

Todo

9

source track: create a "levels" table for the source track

#1111

TomHennen

Todo

10

fill in or cut this bit about merge trains

#1239

zachariahcox

Done

11

'verifiying-artifacts' needs to be updated to match new threat diagram

#1233

Done

12

Clarify how end-users can know the expected value of resourceUri in a VSA

#1212

TomHennen

Done

13

Threats overview page needs to be updated for 1.1

#1208

TomHennen

Done

14

TODO: Need to fill out description of "(I) Usage" in threat and mitigation section

#1182

TomHennen

Done

15

TODO: Need to fill out threat and mitigation of "(G) Distribution channel"

#1180

TomHennen

Done