From 4d0ebdcbeea5657c4c8ff6655677d05bf85b6d4a Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Tue, 1 Aug 2023 19:55:09 -0700 Subject: [PATCH] docs: Add example for maven verification plugin (#676) closes https://github.com/slsa-framework/slsa-verifier/issues/675 --------- Signed-off-by: laurentsimon --- experimental/maven-plugin/README.md | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/experimental/maven-plugin/README.md b/experimental/maven-plugin/README.md index 037e025..a152da7 100644 --- a/experimental/maven-plugin/README.md +++ b/experimental/maven-plugin/README.md @@ -41,10 +41,25 @@ The Maven Verification Plugin can be run from the root of a given project file. 4. `cd /tmp` 5. `git clone _your_repository_` 6. `cd _your_repository_` -7. `mvn io.github.slsa-framework:slsa-verification-plugin:0.0.1:verify` +7. `mvn io.github.slsa-framework.slsa-verifier:dependency-plugin:0.0.1:verify` The plugin will now go through all the dependencies in the `pom.xml` file and check if they have a provenance statement attached to their release. If a dependency has a SLSA provenance file, the Maven verification plugin will fetch it from the remote repository and invoke the `slsa-verifier` binary against the dependency and the provenance file. ### Integrating it into your Maven build cycle -The plugin can also live in your Maven build cycle. If you add it to your own `pom.xml`, the plugin will execute during the validation phase of the Maven build cycle. +The plugin can also live in your Maven build cycle. If you add it to your own `pom.xml`, the plugin will execute during the validation phase of the Maven build cycle: + +```xml + + io.github.slsa-framework.slsa-verifier + dependency-plugin + 0.0.1 + + + + verify + + + + +```