Repository navigation

Verify package attestations and enforce provenance policies in pub get/upgrade - #4875

Draft

mosuem wants to merge 12 commits into

mainfrom

verify-sigstore-attestation

Draft

Verify package attestations and enforce provenance policies in pub get/upgrade#4875
mosuem wants to merge 12 commits into
mainfrom
verify-sigstore-attestation

Commits on Oct 20, 2026
- Support loading Sigstore trusted_root.json from SDK and overrides
  
  mosuem
  authored and
  sigurdm
  committed
  1e706c1
- Verify package attestations and enforce provenance policies in pub get/upgrade
  
  mosuem
  authored and
  sigurdm
  committed
  1cc4a9e
- Use git dependency for package:sigstore
  
  mosuem
  authored and
  sigurdm
  committed
  c155b73
- Only fetch Sigstore attestation when versionInfo has slsaLevel
  
  mosuem
  authored and
  sigurdm
  committed
  735bc95
- Update package:sigstore to ^0.1.0 and use PubAttestationVerifier
  
  mosuem
  authored and
  sigurdm
  committed
  bdc2f27
- Resolve Sigstore trusted root from pub cache and embedded fallback without SDK
  
  mosuem
  authored and
  sigurdm
  committed
  336849c
- Enforce GitHub repository and identity in PubAttestationVerifier
  
  mosuem
  authored and
  sigurdm
  committed
  234d04e
- Verify SLSA provenance payload, bind archive pubspec, and enforce TOFU policy
  
  mosuem
  authored and
  sigurdm
  committed
  248e03b
- Fix lints in attestation tests (line length, unused import, redundant argument, quotes)
  
  mosuem
  authored and
  sigurdm
  committed
  a96a9c3
- Address review: verify by digest, fetch attestation separately, trusted root handling
  
  mosuem
  authored and
  sigurdm
  committed
  7cfab61
Commits on Oct 23, 2026
- Use the provenance parsing and policy from package:sigstore/provenance.dart
  mosuem
  committed
  e0017d2
- Expect attestations per version: lockfile provenance and a versioned cache record
  mosuem
  committed
  c7d67a5

Commits

Commits on Oct 20, 2026

Commits on Oct 23, 2026