MACARON REPORT
2023-05-20 04:07:10
Target information
Full name micronaut-projects/micronaut-validation
Local cloned path git_repos/github_com/micronaut-projects/micronaut-validation
Remote path https://github.com/micronaut-projects/micronaut-validation
Branch master
Commit hash 52987896f5b38df0fef2926cdd295d85417b800a
Commit date 2023-05-16T15:43:44+00:00
Provenance summary
This is the provenance found for this repository.
Reports for Macaron checks
Check id Check description Slsa requirements Justification Result type
mcn_provenance_expectation_1 Check whether the SLSA provenance for the produced artifact conforms to the expected value.
  • Provenance conforms with expectations - SLSA Level 3
  • No policy defined for this repository.
 UNKNOWN
mcn_build_as_code_1 The build definition and configuration executed by the build service is verifiably derived from text file definitions stored in a version control system.
  • Build as code - SLSA Level 3
 PASSED
mcn_build_script_1 Check if the target repo has a valid build script.
  • Scripted Build - SLSA Level 1
  • Check mcn_build_script_1 is set to PASSED because mcn_build_service_1 PASSED.
 PASSED
mcn_build_service_1 Check if the target repo has a valid build service.
  • Build service - SLSA Level 2
  • Check mcn_build_service_1 is set to PASSED because mcn_build_as_code_1 PASSED.
 PASSED
mcn_provenance_available_1 Check whether the target has intoto provenance.
  • Provenance - Available - SLSA Level 1
  • Provenance content - Identifies build instructions - SLSA Level 1
  • Provenance content - Identifies artifacts - SLSA Level 1
  • Provenance content - Identifies builder - SLSA Level 1
  • Found provenance in release assets:
  • multiple.intoto.jsonl
 PASSED
mcn_provenance_level_three_1 Check whether the target has SLSA provenance level 3.
  • Provenance - Non falsifiable - SLSA Level 3
  • Provenance content - Includes all build parameters - SLSA Level 3
  • Provenance content - Identifies entry point - SLSA Level 3
  • Provenance content - Identifies source code - SLSA Level 2
  • Successfully verified level 3:
  • verify passed: build/repo/micronaut-validation-bom/4.0.0-M7/micronaut-validation-bom-4.0.0-M7.module,verify passed: build/repo/micronaut-validation-bom/4.0.0-M7/micronaut-validation-bom-4.0.0-M7.pom,verify passed: build/repo/micronaut-validation-bom/4.0.0-M7/micronaut-validation-bom-4.0.0-M7.toml,verify passed: build/repo/micronaut-validation-processor/4.0.0-M7/micronaut-validation-processor-4.0.0-M7-javadoc.jar,verify passed: build/repo/micronaut-validation-processor/4.0.0-M7/micronaut-validation-processor-4.0.0-M7-sources.jar,verify passed: build/repo/micronaut-validation-processor/4.0.0-M7/micronaut-validation-processor-4.0.0-M7.jar,verify passed: build/repo/micronaut-validation-processor/4.0.0-M7/micronaut-validation-processor-4.0.0-M7.module,verify passed: build/repo/micronaut-validation-processor/4.0.0-M7/micronaut-validation-processor-4.0.0-M7.pom,verify passed: build/repo/micronaut-validation/4.0.0-M7/micronaut-validation-4.0.0-M7-javadoc.jar,verify passed: build/repo/micronaut-validation/4.0.0-M7/micronaut-validation-4.0.0-M7-sources.jar,verify passed: build/repo/micronaut-validation/4.0.0-M7/micronaut-validation-4.0.0-M7.jar,verify passed: build/repo/micronaut-validation/4.0.0-M7/micronaut-validation-4.0.0-M7.module,verify passed: build/repo/micronaut-validation/4.0.0-M7/micronaut-validation-4.0.0-M7.pom
 PASSED
mcn_version_control_system_1 Check whether the target repo uses a version control system.
  • Version controlled - SLSA Level 2
 PASSED
mcn_trusted_builder_level_three_1 Check whether the target uses a trusted SLSA level 3 builder.
  • Hermetic - SLSA Level 4
  • Isolated - SLSA Level 3
  • Parameterless - SLSA Level 4
  • Ephemeral environment - SLSA Level 3
  • Could not find a trusted level 3 builder as a GitHub Actions workflow.
 FAILED