{
  "accessed": "2026-07-22",
  "sources": [
    {
      "name": "SLSA 1.2 specification",
      "url": "https://slsa.dev/spec/v1.2/",
      "needles": ["Version 1.2", "Source Track", "Build Track"]
    },
    {
      "name": "SLSA source requirements",
      "url": "https://slsa.dev/spec/v1.2/source-requirements",
      "needles": ["Source Roles", "Administrator", "Two-party review"]
    },
    {
      "name": "SLSA build track basics",
      "url": "https://slsa.dev/spec/v1.2/build-track-basics",
      "needles": ["Provenance exists", "Signed provenance", "Hardened builds"]
    },
    {
      "name": "SLSA provenance",
      "url": "https://slsa.dev/spec/v1.2/provenance",
      "needles": ["verifiable information", "where, when, and how", "Build provenance"]
    },
    {
      "name": "SLSA terminology",
      "url": "https://slsa.dev/spec/v1.2/terminology",
      "needles": ["Attestation", "Dependency", "Distribution"]
    },
    {
      "name": "GitHub artifact attestations",
      "url": "https://docs.github.com/en/actions/concepts/security/artifact-attestations",
      "needles": ["must be verified", "guarantee that an artifact is secure", "commit SHA"]
    },
    {
      "name": "GitHub Actions threat protection",
      "url": "https://docs.github.com/en/code-security/tutorials/secure-your-organization/protect-against-threats",
      "needles": ["Pin third-party actions", "full commit SHA", "minimum permissions"]
    },
    {
      "name": "Sigstore signature verification",
      "url": "https://docs.sigstore.dev/cosign/verifying/verify/",
      "needles": ["certificate-identity", "included the digest", "verify-attestation"]
    },
    {
      "name": "NIST SSDF 1.1",
      "url": "https://csrc.nist.gov/pubs/sp/800/218/final",
      "needles": ["Secure Software Development Framework", "high-level secure software development practices", "common vocabulary"]
    },
    {
      "name": "npm clean install",
      "url": "https://docs.npmjs.com/cli/v11/commands/npm-ci/",
      "needles": ["package-lock.json", "exit with an error", "installs are essentially frozen"]
    },
    {
      "name": "npm package lock",
      "url": "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json/",
      "needles": ["exact tree", "integrity", "resolved"]
    }
  ]
}