github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-18 19:18:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: Add example for maven verification plugin (#676)

Browse Source 
closes https://github.com/slsa-framework/slsa-verifier/issues/675

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
This commit is contained in:
laurentsimon
2023-08-02 11:55:09 +09:00
committed by GitHub
parent e7fc7a4621
commit 4d0ebdcbee
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
experimental/maven-plugin/README.md
+17 -2
View File
@@ -41,10 +41,25 @@ The Maven Verification Plugin can be run from the root of a given project file.
4. `cd /tmp`
5. `git clone _your_repository_`
6. `cd _your_repository_`
7. `mvn io.github.slsa-framework:slsa-verification-plugin:0.0.1:verify`
7. `mvn io.github.slsa-framework.slsa-verifier:dependency-plugin:0.0.1:verify`
The plugin will now go through all the dependencies in the `pom.xml` file and check if they have a provenance statement attached to their release. If a dependency has a SLSA provenance file, the Maven verification plugin will fetch it from the remote repository and invoke the `slsa-verifier` binary against the dependency and the provenance file.
### Integrating it into your Maven build cycle
The plugin can also live in your Maven build cycle. If you add it to your own `pom.xml`, the plugin will execute during the validation phase of the Maven build cycle.
The plugin can also live in your Maven build cycle. If you add it to your own `pom.xml`, the plugin will execute during the validation phase of the Maven build cycle:
```xml
<plugin>
<groupId>io.github.slsa-framework.slsa-verifier</groupId>
<artifactId>dependency-plugin</artifactId>
<version>0.0.1</version>
<executions>
<execution>
<goals>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
```